Malicious PDF — malware analysis report

Static analysis result for SHA-256 023937406a96a2a9…

MALICIOUS

PDF

46.1 KB Created: 2020-09-02 05:56:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f2f5994ec11932bdd663a62ddcc55522 SHA-1: 4a665dc5e9af888877b14d12f5d187035362418b SHA-256: 023937406a96a2a94b212a5ad4635a29a1b7e4aa313d48a14bca3a46ca1e949d
194 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link to a redirector URL, which is a common tactic for distributing malware or leading users to phishing sites. The document body, though heavily obfuscated, contains text that appears to be a lure for a popular song ringtone, combined with a malicious URL. The presence of numerous links to external PDFs, many of which are benign, suggests a link farm or SEO poisoning attempt to improve the ranking of the malicious URL. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=bangalore+days+songs+ringtone
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://static.usrfiles.com/ugd/26938b_815748aaa7294ed4854231a60f3a6550.pdf
    • https://static.usrfiles.com/ugd/b7082a_d419f2a5a02d49ad81cc40636931031e.pdf
    • https://static.usrfiles.com/ugd/b8c837_dce3492ddc904da6843f81230637b7e9.pdf
    • https://static.usrfiles.com/ugd/0df15e_d5e611e818264077b3b5126d8c49e5c4.pdf
    • https://static.usrfiles.com/ugd/4c76bf_320bd7b5ae464e1484d1593869cb7b95.pdf
    • https://cdn.shopify.com/s/files/1/0429/5327/7603/files/wugigom.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/79894841610.pdf
    • https://cdn.shopify.com/s/files/1/0438/5102/2501/files/galileo_galilei_sidereus_nuncius.pdf
    • https://static.usrfiles.com/ugd/f8de3e_2cfd868b3e06449aaea7dbff58e9352e.pdf
    • https://static.usrfiles.com/ugd/cc3ca9_606c72d0554d425e8a24a0689673ca40.pdf
    • https://static.usrfiles.com/ugd/b8c837_9ac67685347c418a8d01357a5a585f4a.pdf
    • https://static.usrfiles.com/ugd/b8c837_77c0ba7265a04c7b9fa0dbb5962bb5e4.pdf
    • https://static.usrfiles.com/ugd/565485_103e7cb34d064e7886e745e56561cde5.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006a35.bin
b950f7bba1e05c8c43880d76a14c19a5eb8d41266e75cfd50757acbcd62fd87c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6A35 4932 bytes
font_01_sfnt_off00007b07.bin
8ad3bb204bb11e0c33390b38f97fbd4aa71de14d595608fc5ac8a27ebeee449f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7B07 10024 bytes
font_02_sfnt_off00009d48.bin
1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9D48 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.