Malicious PDF — malware analysis report

Static analysis result for SHA-256 06c25650833ee098…

MALICIOUS

PDF

121.6 KB Created: 2020-08-22 05:54:24 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: de17f1f1a564ee9187356a38e0694d9d SHA-1: 9e2b7afa353e2132df41f0b70785d6567ef7e93e SHA-256: 06c25650833ee098622fe00598dd33c6c3d5c8cfb0f5ec8b58e8770d89a9d609
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link farm of 26 external PDF links, with one pointing to a known malicious redirector. The document body also contains a direct link to this malicious redirector. This indicates an attempt to lure users to malicious infrastructure, likely for phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=baalbek+stone+platform
    • http://files.paveauction.org/uploads/1/3/0/8/130814043/tagidafulekat.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0429/2545/7575/files/dudatogogijelujonal.pdf
    • https://cdn.shopify.com/s/files/1/0432/7243/7910/files/sizoferuvuxadopadedapa.pdf
    • https://cdn.shopify.com/s/files/1/0432/0893/3540/files/lageb.pdf
    • https://cdn.shopify.com/s/files/1/0434/5433/3093/files/24992247393.pdf
    • https://cdn.shopify.com/s/files/1/0427/7737/8972/files/lifovexujemakosa.pdf
    • https://cdn.shopify.com/s/files/1/0432/0113/4754/files/wanafamiwovigamuvutiv.pdf
    • https://cdn.shopify.com/s/files/1/0432/5831/4912/files/36028016722.pdf
    • https://cdn.shopify.com/s/files/1/0429/9345/1159/files/70726620065.pdf
    • https://cdn.shopify.com/s/files/1/0434/4122/5880/files/99640091517.pdf
    • https://cdn.shopify.com/s/files/1/0437/1687/0309/files/zijakuxawolelagaw.pdf
    • https://cdn.shopify.com/s/files/1/0428/9570/4227/files/mipajesamu.pdf
    • https://cdn.shopify.com/s/files/1/0434/5842/9089/files/morgana_support_build.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00016160.bin
61b2d6fc959ad9b526dbd1d2b6fb1d5edb608cda4a1a7c82ce36f76178add6f8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16160 5300 bytes
font_01_sfnt_off00017348.bin
6f1e34ff7432b9754334e18457f08967ff2e00884bc1d0a8ac3aeecb988ce5ed		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17348 18800 bytes
font_02_sfnt_off0001accb.bin
7348bc70e3f90a8bdbc55ed24036cc57821571f69471e3cc846d5e4e27ee4311		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1ACCB 18112 bytes
font_03_sfnt_off0001c8ba.bin
30cabc18f5d79eefd03d590722ecd492592c9838a63c6eda66d8e61d1b88fcb8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1C8BA 6260 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.