Malicious PDF — malware analysis report

Static analysis result for SHA-256 026f03a529c5929a…

MALICIOUS

PDF

41.9 KB Created: 2020-09-24 02:54:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ce8743ce020fb4b320e9f61698cd4fc3 SHA-1: cd484a3064327cd8500ff62593baa261af9853f4 SHA-256: 026f03a529c5929adb8015baca99a3af7e686e5ddcdd23f246f0d3c125239b25
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF contains a large number of embedded links, many of which point to external PDF files, forming a link farm. One of the primary links redirects to a known malicious domain, suggesting an attempt to lure users to malicious infrastructure. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=cuanto+mide+la+media+cancha+de+baloncesto
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0463/3385/3852/files/periodic_table_chart_image.pdf
    • https://cdn.shopify.com/s/files/1/0432/7754/9726/files/55477908476.pdf
    • https://cdn.shopify.com/s/files/1/0461/7820/5850/files/horarios_cercanias_bilbao.pdf
    • https://cdn.shopify.com/s/files/1/0427/6482/8839/files/29649545991.pdf
    • https://cdn.shopify.com/s/files/1/0430/0062/7363/files/ritonote.pdf
    • https://e1157c91-cdbb-408b-9eac-050cd79a6d13.filesusr.com/ugd/6c032c_1b6452f62e074cf0b8fcce9b513cb6c6.pdf?index=true
    • https://cd29c4a2-b32f-453f-be7b-47288c0e8144.filesusr.com/ugd/162fe6_4264123051214505a9f52bc9ccd7fd9a.pdf?index=true
    • https://5efc4210-020a-4707-ac4f-9b21ba7004a9.filesusr.com/ugd/ca9b0a_5bbbc381b72443b0be56d106125abc49.pdf?index=true
    • https://f56de312-7e4f-437c-acf8-8567fdb57afc.filesusr.com/ugd/96768c_83517bd075bc495ea4f5ba1dfa5daeae.pdf?index=true
    • https://bec97fc1-130c-42af-baed-4416ef57f486.filesusr.com/ugd/35e1ce_6869e15abaf1434bbdf788be5fd6e090.pdf?index=true
    • https://f04e9f2f-c6f5-46f5-a75f-315c8b64d6a8.filesusr.com/ugd/891219_479b1564ca824ec083cd3bb6265fe90c.pdf?index=true
    • https://db7aa53f-2d42-496d-bbaf-051bb9b5b2c0.filesusr.com/ugd/70e5f7_263309906bd44e52ae19dc201cd13e35.pdf?index=true
    • https://2a1a596c-6db1-4088-8ea1-33bfdd57a1f5.filesusr.com/ugd/e23fbb_038758f12855415c98e475ae8a4398c2.pdf?index=true
    • https://89327100-e193-42dd-a26d-95b3d9395e75.filesusr.com/ugd/704f6c_1ccd6fa1abea449dbb9c56006718ad4f.pdf?index=true
    • https://cc561e6f-8d5e-4023-acbc-bbda306fcba6.filesusr.com/ugd/8a4248_f1d19b574cab4c4485436f8ee3c2fd70.pdf?index=true
    • https://6839e374-bd30-4486-8e74-7429a4583858.filesusr.com/ugd/4ca7f5_4166156575734a10ba49a77f0cb79d2d.pdf?index=true
    • https://8f6b9a2c-6e61-4e82-92ab-14547cc0c0a1.filesusr.com/ugd/1d64af_eefc33df2c1e49379f2d70dc571c4e42.pdf?index=true
    • https://51473f9b-2fc6-401d-826b-ae87e6434cbe.filesusr.com/ugd/99b222_30826b368b1a4db0998df5be462338e9.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000064ca.bin
17c4412bb84e6b6dafd3683553e24eff016accce04c65a70df58f73c9fef5d58		 pdf-font-stream PDF embedded font (sfnt) at offset 0x64CA 5128 bytes
font_01_sfnt_off0000760b.bin
6fb5015fc45d438b860728b48330fa1b4238970ae3e4dcb773ac06fc661606f0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x760B 10632 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.