Malicious PDF — malware analysis report

Static analysis result for SHA-256 05ad670a3a8237db…

MALICIOUS

PDF

64.1 KB Created: 2020-08-30 06:10:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b9e848d4ee35ec7e0011294740f047b3 SHA-1: bb9e1d30c24b5da0ee04351b63e91e6caec77168 SHA-256: 05ad670a3a8237dbf5b1ad572e0a226dd140241408394c865450bd0126cc5bc1
194 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF contains embedded links pointing to a known malicious redirector, which in turn leads to a software crack download lure. The ML classifier strongly indicates maliciousness. The presence of a password-protected archive lure suggests the document is intended to facilitate the download and execution of a secondary payload, likely via the embedded malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=vocalign+pro+4.1.5+crack
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://static.usrfiles.com/ugd/b8c837_0b7039da0d7347e782c7dc53500da723.pdf
    • https://static.usrfiles.com/ugd/b8c837_f6b64974eaf54542941a3648d5c078bc.pdf
    • https://static.usrfiles.com/ugd/5e8de6_1a0eb6a731904174afc456168e25cce2.pdf
    • https://static.usrfiles.com/ugd/191a6d_1b319667619049639c59eabbab91bfeb.pdf
    • https://static.usrfiles.com/ugd/b8c837_17c8f6c4e40b4f0fa3f29c9311347c6c.pdf
    • https://static.usrfiles.com/ugd/b8c837_51dff2fc513d4c2ba5afc9482df72f35.pdf
    • https://static.usrfiles.com/ugd/b8c837_d2a1fcf02e7b413fa64c9be161872fc0.pdf
    • https://static.usrfiles.com/ugd/e33828_341529502c484249b4c1c7400bc62833.pdf
    • https://static.usrfiles.com/ugd/b8c837_ed4c20ac26ab43e2b305166b466f6bc4.pdf
    • https://static.usrfiles.com/ugd/32777b_e3dc3313ae4044d39b70ae92a8764df1.pdf
    • https://static.usrfiles.com/ugd/39cb9d_3c632f4b0715474790f84b4671de8800.pdf
    • https://static.usrfiles.com/ugd/b8c837_382e334395aa4a4f8bcb044adaced5c0.pdf
    • https://cdn.shopify.com/s/files/1/0431/5915/8946/files/delazibem.pdf
    • https://cdn.shopify.com/s/files/1/0429/2860/3295/files/simulador_ceneval_exani_ii.pdf
    • https://cdn.shopify.com/s/files/1/0436/6021/4425/files/compress_to_specific_size.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://sinhala.sourceforge.net/
    • http://sinhala.cvs.sourceforge.net/viewvc/*checkout*/sinhala/sinhala/fonts/CREDITS
    • http://www.gnu.org/licenses/gpl-2.0.html

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ad89.bin
9d09ead17bb30675a75e80220157181881520c2aea881d687ae58e15199b879e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAD89 5248 bytes
font_01_sfnt_off0000bf41.bin
869700f7b438b0b0f23cfbf3a170597ae1a6b01e9ba9f60fe7298d5eefb98f81		 pdf-font-stream PDF embedded font (sfnt) at offset 0xBF41 3840 bytes
font_02_sfnt_off0000cd51.bin
983c87249e0464f5193c5663414b1a142640ed63293ec58588cbd28bba08a479		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCD51 11036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.