Malicious PDF — malware analysis report

Static analysis result for SHA-256 ee5afe1a2e1f9939…

MALICIOUS

PDF

43.8 KB Created: 2020-09-17 08:07:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e46ed7925198a04ce3cc05294ac054e4 SHA-1: f830e69797dc6f53e53721fda88c282adb713c30 SHA-256: ee5afe1a2e1f9939dfb5841e36ac346bb5d658264d5b5d86d16afe0cfeb92017
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to a URL that appears to be a lure for downloading an APK. The document body also contains the same URL and references to 'real steel apk obb download', reinforcing the social engineering attempt. Additionally, the PDF exhibits characteristics of a link farm, with numerous embedded links to other PDF files, suggesting a broader distribution or redirection strategy.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/wix?keyword=real+steel+apk+%252B+obb+download
    • http://files.madisimmons.com/uploads/1/3/0/7/130739570/dceee3e51acf8.pdf
    • http://modamuwi.vivwalkerart.com/uploads/1/3/1/4/131405965/rotewezuti.pdf
    • http://files.allstarwrestlingaustralia.com.au/uploads/1/3/1/6/131637190/sajemutulijuvejegun.pdf
    • http://tazitin.monashsoccerclub.com/uploads/1/3/1/4/131483128/kapilobexoxizi.pdf
    • http://files.preservetennis.com/uploads/1/3/0/7/130775732/864d806ca9163.pdf
    • https://9ac558e1-ca7e-4205-bae9-e6b9480fe6bd.filesusr.com/ugd/1e8759_5736c45ab5e149e8b6e4435a01868886.pdf?index=true
    • https://d0fcab32-cc27-4cf5-8a0c-a425be3acc89.filesusr.com/ugd/80bfa9_04fa3b974cc84c6c9a3440aeb9a8f69b.pdf?index=true
    • https://1b482a88-c35d-438c-a84d-7d93de57fb67.filesusr.com/ugd/0cd019_238721238ce5443fa158a9cea1f3026c.pdf?index=true
    • https://cdn.shopify.com/s/files/1/0466/3479/5173/files/xobupemijokegiluserowemu.pdf
    • https://cdn.shopify.com/s/files/1/0432/4245/5197/files/korg_arp_odyssey_review.pdf
    • https://cdn.shopify.com/s/files/1/0431/9058/3458/files/the_gamer_manga.pdf
    • https://cdn.shopify.com/s/files/1/0462/4488/8730/files/photos_jard_sur_mer.pdf
    • https://cdn.shopify.com/s/files/1/0427/5548/9948/files/37995133259.pdf
    • https://7bd5dad2-f811-4c39-83c7-13ddd0809412.filesusr.com/ugd/d6b5da_ccdf9500eea44340a67c1529745f0542.pdf?index=true
    • https://aa35c5eb-8a4f-4fc1-a6f6-39657cd5936e.filesusr.com/ugd/b916f4_a1c0d4e8419e4c1caf8e18cbb831ce15.pdf?index=true
    • https://d1946ad7-a2d3-44e1-9580-4a1c2544556e.filesusr.com/ugd/8e7730_7bbc749e12934dcfa631470a4c15dd7b.pdf?index=true
    • https://e2f73c8e-7364-4d8a-be20-6ea7d03ba7ce.filesusr.com/ugd/8a4248_dae12a988ea743cba5c4d3b044fbc1d4.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006b95.bin
fa26e4c0dc1e9c3ce1950de42aa9d0b7bf98ec28c9788878f24af2f63bf531bd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6B95 5160 bytes
font_01_sfnt_off00007d48.bin
3cf4f0ab79acff37b367b5ea1c19e81e1c9c974dc2f8f9f8ff4e608fc042a04d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7D48 10784 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.