Malicious PDF — malware analysis report

Static analysis result for SHA-256 0190f2cb2b1c21e2…

MALICIOUS

PDF

52.7 KB Created: 2020-08-30 23:39:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 856b9a84f5ab0d25a4cca049ad63d160 SHA-1: 3ab3cdc8048512231f3ac752d2056579be5b62e7 SHA-256: 0190f2cb2b1c21e2c3801dabc68e50dd7217dfd31702f9a61e7e9831dbbd3141
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links, with the primary link redirecting to a malicious domain disguised as a search result. The ML classifier and critical heuristics strongly indicate malicious intent, likely to lure users to malicious sites through a deceptive link farm.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=heat+transfer+7th+edition+solutions
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://static.usrfiles.com/ugd/538d67_85aa3d86a25142cfa34b3c0e3bfea3d6.pdf
    • https://static.usrfiles.com/ugd/b8c837_73f291fefe554f6cb4345bd5383cd736.pdf
    • https://static.usrfiles.com/ugd/3b47cb_3aad383fbf7b4e058490731ad12c6d94.pdf
    • https://static.usrfiles.com/ugd/ab059d_b87a971aa219459ea91d201c7b599de3.pdf
    • https://static.usrfiles.com/ugd/1a89c8_39c92a674fcf4864875542693c5095cb.pdf
    • https://static.usrfiles.com/ugd/b8c837_344215e993c5403eb9505e7d16cfb44e.pdf
    • https://static.usrfiles.com/ugd/49be48_6c602f4418fb4b72a8b221802b0dde5c.pdf
    • https://cdn.shopify.com/s/files/1/0430/6380/4058/files/bcs_preliminary_question_bank.pdf
    • https://cdn.shopify.com/s/files/1/0437/9561/1809/files/kubixusujidize.pdf
    • https://cdn.shopify.com/s/files/1/0433/5727/4261/files/caltas_gym_busch_blvd.pdf
    • https://static.usrfiles.com/ugd/b8c837_0202632f4e124db693db91f62f856c52.pdf
    • https://static.usrfiles.com/ugd/b8c837_5c7005fbcfba4d9e8714414bc9b18814.pdf
    • https://static.usrfiles.com/ugd/b8c837_503414e442aa49bbb593ca11311bd4c1.pdf
    • https://static.usrfiles.com/ugd/b8c837_fdc282079e82424ca25f13a1dc5378d9.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_005_off0000a164.bin
113d9ffe91c48ef09090871fc62105bb5fd391b24bc36f398e7053516f393a0a		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xA164 20672 bytes
font_00_sfnt_off00006c36.bin
50f702c8f06c1bac2c460e999c25963e7e40ef32c341d39073ae1c16cce1f416		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6C36 5036 bytes
font_01_sfnt_off00007d4b.bin
f8495050f3d6fd00a966901e65101db36847e0ae745d7c0aab67f1239f435627		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7D4B 10776 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.