Malicious PDF — malware analysis report

Static analysis result for SHA-256 f49f15133459aa0f…

MALICIOUS

PDF

44.0 KB Created: 2020-10-28 17:46:58 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-05
MD5: 28fbefcc290b3200b35c559ec33c0ca3 SHA-1: bdfdade5bd4487f65fd032a2487975b85441e35b SHA-256: f49f15133459aa0f42641c3ec4d4b2231b9311822242d1fcd276a3dc9af70bc9
154 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document was flagged by multiple heuristics as malicious, specifically for containing a large number of external links and redirector infrastructure. The embedded URLs suggest a link farm or SEO poisoning tactic, likely intended to lure victims to malicious content or phishing pages. No scripts were extracted, but the presence of numerous links indicates a phishing or redirection attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/strik?keyword=conflicts+between+state+and+national+government In PDF document text
    • https://javodamujuwevef.weebly.com/uploads/1/3/4/4/134446411/vitejupuva.pdfIn PDF document text
    • https://lokixesope.weebly.com/uploads/1/3/1/6/131607163/fugebum_zejisuzeputug_bumuvokoponul.pdfIn PDF document text
    • https://gexirirexov.weebly.com/uploads/1/3/0/8/130874239/272811.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4377128/normal_5f8d6179386e4.pdfIn PDF document text
    • https://xivenisulebitok.weebly.com/uploads/1/3/1/3/131378814/c046ce9f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366354/normal_5f9180f04aabf.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4383688/normal_5f8be20379df0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4413122/normal_5f93bac489e9f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387718/normal_5f9336a20925f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4372972/normal_5f9494e7023df.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4378381/normal_5f8fabdcc223e.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/a59d8284-238c-49b2-ac77-28feda1ced11/pathfinder_dirty_fighter.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3343d099-4277-4a31-9dbb-ff69eb641d8e/34949171244.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2d0e57d9-5713-461a-8cbb-3bced6b3ccf7/adventure_time_games_break_the_worm.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0498/3478/6971/files/hunter_college_social_work_masters_tuition.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0434/0357/5454/files/reflection_refraction_diffraction_interference_worksheet.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c9d780b3-74f5-4d24-a3d4-51f0b3834dab/59615466791.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9eea750c-2df9-4a70-837f-1c1cb9457286/dumbbell_chart_excel.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c94dcf7b-9ffe-4eae-afa7-45be54727b56/28671051534.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6c00c0b5-22ac-487d-bcdb-39e9eadb00a5/vodutetekalojovunili.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/981a7a9f-500e-48c0-8c8d-3ab1aed0d95e/damupes.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5e7d057c-0af7-4b7b-aa05-75d1feb1f64b/63517425279.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006c8e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6C8E 5536 bytes
SHA-256: afd47eb7ef262f9bed95c54dd68c396c12e5295e14e57bf9430d6c00c4aa4626
font_01_sfnt_off00007f67.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7F67 10400 bytes
SHA-256: 45e7261b00aa126216c4c2e860b694912a3835ee830faf258ec70725387aa5a1

Open this report in the interactive analyzer, or submit your own file for analysis.