Malicious PDF — malware analysis report

Static analysis result for SHA-256 f43bc412a7dfbffa…

MALICIOUS

PDF

45.4 KB Created: 2020-10-28 13:31:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-14
MD5: 2ccf4da2c37af52c653101f21ee0e320 SHA-1: 8bdd4b798815fd022369480fc85ff367c09a49a7 SHA-256: f43bc412a7dfbffa4fa98eb86cdb0ffe9253b9ab0b42f72f2eb46519af23b6b2
154 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded links, with a critical heuristic identifying a link to a known malicious redirector. The document body, though heavily obfuscated, contains a URL that appears to be the primary lure. The presence of multiple external PDF links suggests an attempt to create a link farm for SEO poisoning or to distribute further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/strik?keyword=apk+here+kinguser+4.4.4 In PDF document text
    • https://cdn-cms.f-static.net/uploads/4405922/normal_5f961927d83f2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368485/normal_5f964aa9d8712.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/8fdf8312-498b-47a9-bbc9-ca1ff98b4006/36040381556.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/da8627c8-17f1-4061-80bb-048183a8c375/74729274714.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/97c7f1cd-f356-4dbd-a3cf-31d4b0b6f160/97831109181.pdfIn PDF document text
    • https://s3.amazonaws.com/zirojopemup/vizokipakilowuvavib.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/767088eb-6555-4d8b-85f0-d9fd3c9de932/jedepofebemufowes.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c093a9be-00f8-479d-9a12-3ea94ab470a5/dream_of_sunday_afternoon_in_alameda.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0266/9523/7813/files/43095684995.pdfIn PDF document text
    • https://s3.amazonaws.com/jadere/15260818172.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/53840aa6-6b6e-4147-8422-493944d253b0/zegugutugezogigutuwuw.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0497/7914/6919/files/gukepudibov.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3c551651-d196-449e-b01e-1cf767023f15/12793529968.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/faeb5d27-06fe-43b3-b099-589085e8ea54/83691168925.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0f9b9d31-a876-43cc-a8b6-1a5e104400da/tijonafilaxuket.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9c540041-0418-40bc-8db7-06e2c823ce2c/code_red_meal_plan.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0500/5718/3400/files/how_to_make_a_bookshelf_in_minecraft.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0437/0805/5720/files/45533236118.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0435/9258/1283/files/virtual_boyfriend_games_for_android.pdfIn PDF document text
    • https://s3.amazonaws.com/gurowozenupifi/lacrosse_goalie_drills.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fc6a4738-510d-4d31-a3c9-ecd41b4ed35e/lunidugedoseruzit.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000072e0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x72E0 5012 bytes
SHA-256: c56c336853250aa3c1b6a471ce908a7f77b63d15a895bbb420da3563c690d59f
font_01_sfnt_off000083fc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x83FC 10628 bytes
SHA-256: 45874102e216b44e150a3d11c16a1bd85cefd92c1e426788989844d7b4e78731

Open this report in the interactive analyzer, or submit your own file for analysis.