Malicious PDF — malware analysis report

Static analysis result for SHA-256 f4e54dd9ccaae69b…

MALICIOUS

PDF

39.7 KB Created: 2020-10-26 14:41:21 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-14
MD5: 97a9f8b387f44f8ad09759a42925792d SHA-1: 9b86005e0092bfccf9f333d21346450909f526ac SHA-256: f4e54dd9ccaae69bdfba2357cbff1f6d8b61c7e3447b5ecdce6d31a71e1073b2
154 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains numerous embedded links, with one identified as a malicious redirector. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of external links, suggesting an attempt to manipulate search engine results or distribute content. The presence of a malicious redirector URL points towards a phishing or content-luring attack. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=castrol+edge+0w20+pdf In PDF document text
    • https://lagukekejase.weebly.com/uploads/1/3/0/8/130815031/ruloxisok.pdfIn PDF document text
    • https://sokuvotaboraj.weebly.com/uploads/1/3/0/7/130776263/sevufujarix.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384652/normal_5f91d310b6f3a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4375070/normal_5f8b6730af0bb.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370074/normal_5f889bd63c0a6.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/794d55cb-8b99-42a6-aee4-3a815e92f3b7/vuzawazarakabafi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c0353bde-1ee0-405d-b048-6af225b84908/47149755492.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f9776385-5afb-4a7c-8542-df065954f329/fire_hd_8_tablet_with_alexa_review.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/979a24f5-e287-434c-bb4a-8189deaed610/kate_walsh_net_worth.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f00e5829-3467-45ac-91d0-cf304f61c727/pojasibivuxopopozulix.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/805b86de-9e3a-4dff-b6fc-d041ca25dbce/texto_argumentativo_sobre_el_tabaco.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0266/9261/6388/files/54305946666.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0431/4575/6821/files/56861678272.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6b2cabc9-eb3e-49bd-ad34-6b4b39bfd0ac/14468802873.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9b2bacd8-b574-4505-b77b-31566c08c33e/kubezugu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fa229430-58d4-4665-a768-72830501b001/zikigexikavuxologizusu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/14de59df-622d-4c71-9480-ef0a63b8b740/22426987067.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005bfb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5BFB 5480 bytes
SHA-256: 896d465482f75d0b054966b7ace1c03f0cef916124d06f286aba518777d7746d
font_01_sfnt_off00006ec6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6EC6 10388 bytes
SHA-256: 5b38f14cabbe4ecf48d082f6f23a345fd3c3088e547f12f953540d5535c3d185

Open this report in the interactive analyzer, or submit your own file for analysis.