Malicious PDF — malware analysis report

Static analysis result for SHA-256 00694bde0bb9ae36…

MALICIOUS

PDF

45.1 KB Created: 2020-09-12 04:18:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 53366585081be180e35051d1504e1033 SHA-1: 208bba5f151dbdebd4cd5ec8334b304111b5fc9f SHA-256: 00694bde0bb9ae361573ce418bea7766f46ce62fe591a03e2a0903f99106c879
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF contains a link to a known malicious redirector, which is designed to lead users to potentially harmful content. The document body, though heavily obfuscated, contains the same lure URL and references a 'Vsco cam filter guide', suggesting a social engineering pretext. The presence of numerous external links, many pointing to benign PDFs, indicates a link farm strategy, likely to improve search engine ranking and distribute malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/wix?keyword=vsco+cam+filter+guide
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://static.usrfiles.com/ugd/2ca09c_e5f76339b9c844a4ba27e1789bf6c89a.pdf
    • https://static.usrfiles.com/ugd/8e9e2f_564de93e42ea4d7eb4083f87dae485d3.pdf
    • https://static.usrfiles.com/ugd/b7306e_1bce5cb0c8274461a83ec0ed2551dfab.pdf
    • https://static.usrfiles.com/ugd/0dd040_f2eefaf4667c41ac89814b76fd3051fd.pdf
    • https://static.usrfiles.com/ugd/5cf23b_24de0769a25b46a2bc2487f2a5b2873f.pdf
    • https://cdn.shopify.com/s/files/1/0435/8812/4829/files/fodenepise.pdf
    • https://cdn.shopify.com/s/files/1/0430/1121/1425/files/xerebeniveramomevupoled.pdf
    • https://cdn.shopify.com/s/files/1/0462/2453/9802/files/jopemujog.pdf
    • https://static.usrfiles.com/ugd/9f69bd_b3f16f3e2ecc4013b698ddade9e9f744.pdf
    • https://static.usrfiles.com/ugd/b8c837_839798b4cd984c068e33bf5e1ff58a84.pdf
    • https://static.usrfiles.com/ugd/7f614e_7ca233efdb0e4e559376d64bb242164c.pdf
    • https://static.usrfiles.com/ugd/c162b3_72bc1fff8b8647609af5d839efe72c71.pdf
    • https://static.usrfiles.com/ugd/0baf77_c265a8037b69447cad6ea665fb7a85ec.pdf
    • https://static.usrfiles.com/ugd/361045_7e6b74d7298c4d92adb45ae1df018e5f.pdf
    • https://static.usrfiles.com/ugd/5438e3_91bfe9921e6a402d8f33a565fb772661.pdf
    • https://static.usrfiles.com/ugd/b8c837_ef9bff7715084d1098bf4381f9438443.pdf
    • https://static.usrfiles.com/ugd/cb4a18_ef9d1e8705254128b25b18683574a777.pdf
    • https://static.usrfiles.com/ugd/ef253e_18d93b5727a64f0aa7c27170824e4c6d.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000071a3.bin
17f4f196ec58c0d52ba2acf29fa9975b2117058d3c8566869024b6c9203c0f77		 pdf-font-stream PDF embedded font (sfnt) at offset 0x71A3 5304 bytes
font_01_sfnt_off0000839b.bin
30a6569681ce0e8a62e704bceaed87697e342988910e865bf90f35f9f5e706f5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x839B 10380 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.