Malicious PDF — malware analysis report

Static analysis result for SHA-256 ff9c71f49b65e5cd…

MALICIOUS

PDF

52.5 KB Created: 2020-09-19 04:30:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c6c9ef38e712deecfd80302703eb7da8 SHA-1: 2baaebb6ff2886f26fa339b2838db35c22bddbb8 SHA-256: ff9c71f49b65e5cd4152c3b4de7f8a0b919c176084483a67d2afda6ff2b55993
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by a machine learning classifier and contains a critical heuristic indicating it links to known malicious redirector infrastructure. The document body and embedded links point towards a lure for 'free cracked apk games', likely intended to trick users into downloading malware. The presence of a large number of external PDF links further supports a malicious intent, possibly for SEO poisoning or distributing further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/wix?keyword=free+cracked+apk+games
    • http://wokobezum.instepdance.ca/uploads/1/3/1/8/131856435/zuwovike_kumujakemudefo.pdf
    • http://files.camilavesth.com/uploads/1/3/0/7/130738974/vedokuzadex.pdf
    • http://files.happywayhealing.com/uploads/1/3/0/7/130775845/2686573.pdf
    • http://files.thevisualnarrative.com/uploads/1/3/2/6/132681670/93d40ffd2c17.pdf
    • http://xufisoti.charlotteareabridalshows.com/uploads/1/3/0/7/130775531/werobelowukasofadoru.pdf
    • https://cdn.shopify.com/s/files/1/0434/3146/1016/files/rurifutukojode.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/sovaratumu.pdf
    • https://cdn.shopify.com/s/files/1/0432/7977/7945/files/refeximupamanoveduga.pdf
    • https://b45edc10-5bb1-4c1a-9771-423fef52dcb0.filesusr.com/ugd/866690_e40057de1d954534b03504b2865b7c7f.pdf?index=true
    • https://a0f52d91-9e0f-477d-911a-9eff9b022086.filesusr.com/ugd/fb5067_aa08cd02ca6841cb8b526b30c564e11b.pdf?index=true
    • https://cb4f1b2e-1fe2-4368-823c-034138ef1cd9.filesusr.com/ugd/d2cc1f_250d65ce15f44b6880342d98436b1d25.pdf?index=true
    • https://1794ab9a-c366-4e06-9fbb-272271797f39.filesusr.com/ugd/91e123_8e7fb55497404ad68770996549c42e48.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000627c.bin
307a6d15f0aa2e550e81c853d370bfa92d1e60f2cc97090c86e317393c847491		 pdf-font-stream PDF embedded font (sfnt) at offset 0x627C 4824 bytes
font_01_sfnt_off000072d2.bin
2f3a21950c8d9236e6628c5eb3948d17d1ad8721f7d7a5e1d95d53ea6fe8ca5d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x72D2 2408 bytes
font_02_sfnt_off00007d4d.bin
fa6cddb7dbf580b939291aeb40be153714682975115dfa89635bbe8427f61239		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7D4D 10620 bytes
font_03_sfnt_off0000a1e8.bin
ea75db71c9df7250347a03039f742fcd189f5fc3f08964e696816fa8b5227073		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA1E8 16092 bytes
font_04_sfnt_off0000b6b0.bin
1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB6B0 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.