Malicious PDF — malware analysis report

Static analysis result for SHA-256 051c36cef2a9d809…

MALICIOUS

PDF

46.1 KB Created: 2020-08-30 17:54:17 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5f6cdcb3d10e97cd0279acc700e172ec SHA-1: ee338531e3216fbf73a8a815776d8a1afc3f84a9 SHA-256: 051c36cef2a9d80924e03fbbd407e6a14fbb7fa05c5640afbc4bb79984e1a96e
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links, with one specifically identified as a malicious redirector. The ML classifier also strongly indicated maliciousness. The embedded links likely serve to lure users to malicious sites, potentially for phishing or to download further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=zero+two+smiling
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://static.usrfiles.com/ugd/b8c837_ee54e5af58e14636a35fe75f85312b15.pdf
    • https://static.usrfiles.com/ugd/b8c837_2977d4f4b08f41228e7cb93640987667.pdf
    • https://static.usrfiles.com/ugd/b8c837_488d2be21b5e4570abc6eb9384c0f90e.pdf
    • https://static.usrfiles.com/ugd/ceb2e8_f44b322bcaf34d3199fc7e42ee16aef0.pdf
    • https://cdn.shopify.com/s/files/1/0433/4243/0362/files/alcanos_ramificados_ejercicios.pdf
    • https://cdn.shopify.com/s/files/1/0429/9898/8949/files/telugu_andhra_jyothi_news_paper_today_download.pdf
    • https://cdn.shopify.com/s/files/1/0430/4168/5665/files/bosch_dishwasher_installation_manual.pdf
    • https://static.usrfiles.com/ugd/a4e402_b1528494191744dda890487ab76095ee.pdf
    • https://static.usrfiles.com/ugd/6cf392_aae7f39118dc44d6a6e58a11c977b182.pdf
    • https://static.usrfiles.com/ugd/b8c837_d824dd26c0dd4b38ba26063f9bb9d10e.pdf
    • https://static.usrfiles.com/ugd/b8c837_0eb3a93c1f1a424090ce6f63b8e968f0.pdf
    • https://static.usrfiles.com/ugd/4117a9_4f4eb8fd5a3449278f92cbb493daea61.pdf
    • https://static.usrfiles.com/ugd/39cb9d_ef54e20540714a6d97a6b7a1fcbe9950.pdf
    • https://static.usrfiles.com/ugd/b8c837_9f1b9f5a88e84d1e847c33a712fe93b2.pdf
    • https://static.usrfiles.com/ugd/b8c837_837c817a941248b3b46c4824b42c1f69.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006a53.bin
4ab66a3ed4cda60098a1ab41b74e0c9f7005c9073f69e8e3e6b2c073a6aa6e3b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6A53 4632 bytes
font_01_sfnt_off00007a05.bin
2c7fe5a5aade5ac5d485b97b6df5d37b574ed3a82e117340f6a36d7071cc7df3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7A05 10816 bytes
font_02_sfnt_off00009dcc.bin
4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9DCC 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.