Malicious PDF — malware analysis report

Static analysis result for SHA-256 037105deb92936dd…

MALICIOUS

PDF

46.2 KB Created: 2020-09-08 07:07:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ee88d0dffa9cfa56008f1dc108a03af9 SHA-1: 47f2adffdc5ba080e2f499ea6623ac0bc69e7793 SHA-256: 037105deb92936dd30f34a5367b298f6c31c613e4a4bdff95c0d886758989a02
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains embedded links, one of which points to a known malicious redirector. The document body, though heavily obfuscated, contains the same URL, suggesting an attempt to trick users into visiting a malicious site. The presence of numerous external PDF links further indicates a link farm or redirection strategy.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8944

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=aww+tera+happy+bday+song+audio
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://cdn.shopify.com/s/files/1/0430/6147/7527/files/infinite_warfare_beta_error_code_lumen.pdf
    • https://cdn.shopify.com/s/files/1/0433/1854/2504/files/phytophthora_life_cycle.pdf
    • https://cdn.shopify.com/s/files/1/0435/7105/2707/files/povebutivalir.pdf
    • https://cdn.shopify.com/s/files/1/0434/8493/8402/files/7082393109.pdf
    • https://cdn.shopify.com/s/files/1/0465/8397/2007/files/97005829464.pdf
    • https://static.usrfiles.com/ugd/b8c837_8417fa4b33b741ca9dab5101dfc5ddc9.pdf
    • https://static.usrfiles.com/ugd/daca0d_fc06cec267e5498ba03060347079ff9f.pdf
    • https://static.usrfiles.com/ugd/843280_62c2de8fe8d54f53acfaf977a24a7ff0.pdf
    • https://static.usrfiles.com/ugd/493135_627a39272a754fdfae8d1f481c8b81af.pdf
    • https://static.usrfiles.com/ugd/b85eb0_6cf6e9782de746f68fc4be0be5c45289.pdf
    • https://cdn.shopify.com/s/files/1/0433/4452/7511/files/game_of_throne_vostfr_streaming.pdf
    • https://cdn.shopify.com/s/files/1/0430/9755/5093/files/vavegufunigijanon.pdf
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000049c6.bin
21901ef61b06dda1f57755db9fce908187ffeedb30218414eeefa557eebf07a9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x49C6 5392 bytes
font_01_sfnt_off00005c1d.bin
9530f1729a7c073927d4429f20585726dedbea1fa1506b03ff38c33617eb54a5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5C1D 14560 bytes
font_02_sfnt_off0000899e.bin
e58e8e8d3617fa2f52d62469859eb662c26c1c1537dc21f5cc6f1aa71eaa6aed		 pdf-font-stream PDF embedded font (sfnt) at offset 0x899E 18776 bytes
font_03_sfnt_off0000a705.bin
9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA705 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.