Malicious PDF — malware analysis report

Static analysis result for SHA-256 035033a6f4cf5dca…

MALICIOUS

PDF

59.9 KB Created: 2020-08-20 18:02:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fdd398b05c3b4bdeec4726319d9c1c98 SHA-1: 9034f2efc4d4d95d1c8a7e98513018aba93b3407 SHA-256: 035033a6f4cf5dca1c241a15890e9a68c8880893ace8c47698496bd74de596ea
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a lure in the document body, 'Please help translate vietnamese to english answers', which is associated with a malicious redirector URL. The heuristic PDF_MALICIOUS_REDIRECTOR_LINK confirms this, and the PDF_SEO_LINK_FARM heuristic indicates a large number of external PDF links, suggesting a link farm or content distribution network for malicious files. No scripts were extracted, but the presence of embedded URLs and the ML classifier's high confidence score point towards malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=please+help+translate+vietnamese+to+english+answers
    • http://files.livelikelove.net/uploads/1/3/1/4/131437701/4410130.pdf
    • http://files.folkestonechoralsociety.org/uploads/1/3/0/8/130874329/c431d87b8d.pdf
    • http://files.betweenheavenandearth.org/uploads/1/3/1/8/131857650/xenere_sikarazas_fosafi.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.opentle.org
    • https://cdn.shopify.com/s/files/1/0430/2359/7725/files/comparing_strings_in_java.pdf
    • https://cdn.shopify.com/s/files/1/0444/8436/2407/files/velocity_and_acceleration_problems.pdf
    • https://cdn.shopify.com/s/files/1/0431/7741/0720/files/21299793540.pdf
    • https://cdn.shopify.com/s/files/1/0429/7913/1551/files/29013659394.pdf
    • https://cdn.shopify.com/s/files/1/0437/4138/0769/files/16293508872.pdf
    • https://cdn.shopify.com/s/files/1/0440/5559/3110/files/5787815739.pdf
    • https://cdn.shopify.com/s/files/1/0429/5327/7603/files/la_vida_en_mexico_madame_calderon_dela_barca.pdf
    • https://cdn.shopify.com/s/files/1/0432/2626/7816/files/34080978303.pdf
    • https://cdn.shopify.com/s/files/1/0437/9269/5458/files/67288832927.pdf
    • https://cdn.shopify.com/s/files/1/0439/4477/1739/files/84857033550.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://www.gnu.org/licenses/gpl.html
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000052f2.bin
b5244129e47941c8976d714cb04abf4129082a184ae9678f240016a5640218d4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x52F2 12928 bytes
font_01_sfnt_off00007d59.bin
bb30fb6e6d6a80cb3ebf855a1d8073250cbee39092efd665c84092632daa13b3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7D59 5388 bytes
font_02_sfnt_off00008f87.bin
8a71299ca004a780aabc2396836f153da167a37ddfc59179d5660e1cfa3057b5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8F87 8148 bytes
font_03_sfnt_off0000a624.bin
5372b09697fab6d7a68209bf92d701b66ee29b5cdcb221684d07ea2dd383d090		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA624 10024 bytes
font_04_sfnt_off0000c8aa.bin
487b2dae17ea1786ff3facc80aea55bfa1b0058ddb2f26e1ad0152f81c909912		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC8AA 17036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.