Malicious PDF — malware analysis report

Static analysis result for SHA-256 0651cb985be14f89…

MALICIOUS

PDF

47.8 KB Created: 2020-09-17 12:26:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 011444b24bc1a942cd0a695abea630ab SHA-1: 8fccb9baba6ba475b48bdb795908db8e4ea77140 SHA-256: 0651cb985be14f8913d5510238cc65428d974bbfff350909e17bcc312ae756c8
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document contains numerous links, with one identified as a malicious redirector. The heuristic firings indicate a PDF link farm and a malicious redirector, suggesting the primary goal is to direct users to potentially harmful websites. The ML classifier strongly supports the malicious nature of this file.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=the+road+back+to+you+study+guide
    • http://files.edgewoodfarms.net/uploads/1/3/1/4/131437766/8a3e1d73.pdf
    • http://mewis.t9corp.com/uploads/1/3/0/7/130775565/0c459.pdf
    • http://files.crossroadsbarnwell.org/uploads/1/3/1/4/131409200/xobolipasixalipatiba.pdf
    • http://niperen.circuitsolution.com/uploads/1/3/1/0/131070487/7432568.pdf
    • http://files.zeitzoff.com/uploads/1/3/0/7/130739986/xagiratewiwe.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0486/0529/8853/files/igneous_rocks_worksheet_answers.pdf
    • https://cdn.shopify.com/s/files/1/0435/5692/9687/files/rubiresapubijejejixuk.pdf
    • https://cdn.shopify.com/s/files/1/0431/4939/4080/files/rixepelabakukenatesikof.pdf
    • https://cdn.shopify.com/s/files/1/0438/6386/7552/files/43359836336.pdf
    • https://bcd7fb16-e6c7-4a05-becf-636a62477620.filesusr.com/ugd/53c654_e0e36ae949284f96838ad964b8a6d939.pdf?index=true
    • https://42c58796-45ab-48c8-b5f3-208754c915de.filesusr.com/ugd/724fb5_879a5eaf80dc4c58a5400babd0a42208.pdf?index=true
    • https://3de1cdce-cfd8-4296-a128-3e0a5a3e0dbd.filesusr.com/ugd/c88839_1c522004ea4c4927a8c8a2215532f125.pdf?index=true
    • https://947ea237-1071-4ce5-85a0-0e84b78a9666.filesusr.com/ugd/04e6f9_72b0bf69f1654b43b12747810e284c13.pdf?index=true
    • https://771fce43-e1e2-45d2-80a5-3f178adf6148.filesusr.com/ugd/c8f33b_b27e4aa930d144a59bfbe6bc327d0d69.pdf?index=true
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/vukabisozudetilo.pdf
    • https://cdn.shopify.com/s/files/1/0436/4910/6080/files/achyutam_keshavam_lyrics_in_kannada.pdf
    • https://cdn.shopify.com/s/files/1/0432/3098/6400/files/amharic_dictionary.pdf
    • https://cdn.shopify.com/s/files/1/0431/1118/6585/files/venta_de_vidrio_liquido_para_manualidades.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007d85.bin
6bdb9073831811b8a9731cc4330c8159776d62f6bd102c65dc261aa757e15fd2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7D85 5424 bytes
font_01_sfnt_off00008ff6.bin
3997742f95e6166af95ba8601c98fe14e7a09497a0fed17c98bdae400cd92cf5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8FF6 10076 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.