Malicious PDF — malware analysis report

Static analysis result for SHA-256 f2f0609ff3f9e72a…

MALICIOUS

PDF

47.7 KB Created: 2020-10-04 03:56:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: f71ba00e635ab453f377518cac908d8c SHA-1: fd043bd83ad62688fa453c2ea101296c1e551f68 SHA-256: f2f0609ff3f9e72a223630f07c0e864797e6a153715ec1ba5ff70c3f445b76b5
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains numerous embedded links, identified as a link farm, with several pointing to known malicious redirector infrastructure. The document body, though heavily obfuscated, contains a URL that appears to be part of the SEO spam lure. The ML classifier strongly indicated maliciousness, supporting the conclusion that this is a malicious document designed to redirect users to harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/pify?keyword=schlumberger+malaysia+organization+chart In PDF document text
    • http://files.stmarymagdalenewpg.org/uploads/1/3/1/8/131856531/badifa.pdfIn PDF document text
    • http://files.piercingcrossfit.com/uploads/1/3/1/4/131437849/a1ce08ec7d382.pdfIn PDF document text
    • http://files.afsanehtorabi.com/uploads/1/3/2/6/132695387/zapasamonotegun.pdfIn PDF document text
    • http://mafafof.electronic-cemetery.com/uploads/1/3/0/7/130738885/fosujifaf.pdfIn PDF document text
    • http://files.onestepforwardcounseling.com/uploads/1/3/0/7/130739264/c3e8a994f343.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/8e1658cc-e6e2-468d-b13e-e0ec7df870a4/23021115769.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/03665a14-9c0a-463a-b033-da021c55b61d/xaramud.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0b2908d2-4e87-4586-8b3b-93e4b97e2f87/dedasif.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/783afc43-1d30-4fe4-9aa0-3b297ace2784/kudamiferupidowa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6d7894d6-4d66-4307-863d-6bd8a38d7a2f/68456720208.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/133af395-1e0d-41a2-badc-fe5552d49f8e/42431828057.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e8a00d74-549c-4068-b4c5-414bc6d54343/denebemunokomujubetarus.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f9c2372b-ef97-4409-8bdb-9a81ea34f60c/fazepabajewabepuj.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007830.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7830 5608 bytes
SHA-256: 919fdd0a3710ab8669cefa4ca53b8143da06169c722aa4efb45efb31f0cf0837
font_01_sfnt_off00008b25.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8B25 11456 bytes
SHA-256: 282abb43e0a7deba331e4f0f5f04473b210c6e920b83ee4713ede8c73fa369b9

Open this report in the interactive analyzer, or submit your own file for analysis.