Malicious PDF — malware analysis report

Static analysis result for SHA-256 078400d23a6816d4…

MALICIOUS

PDF

50.6 KB Created: 2020-09-20 00:46:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 09294f5c1528b4c8091a34ea24822ae7 SHA-1: a0dd3458c65bf72b15ab11ce7ba7ce516007eab6 SHA-256: 078400d23a6816d447f81a30ac9e1752125edea4053c6b885826adf40247ebbf
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links, with at least one identified as a malicious redirector. The ML classifier also strongly indicated maliciousness. The document body, though partially corrupted, contains a URL that matches the malicious redirector found by heuristics, suggesting an attempt to drive traffic to malicious infrastructure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/wix?keyword=dones+y+frutos+del+espiritu+santo+en+la+biblia
    • http://files.diymandalastones.com/uploads/1/3/2/6/132695601/1e5bf.pdf
    • http://files.downrightdiving.com/uploads/1/3/0/7/130738852/vuwonutunorux_basilazer_koralu.pdf
    • http://files.erikahanneson.com/uploads/1/3/2/6/132695571/piwivomunoxoda-tegozux.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://30c2a2d2-20f8-4db5-9b30-08a2cc75c71a.filesusr.com/ugd/d78803_5f57e74b91894b4f97d06833378fd8ea.pdf?index=true
    • https://3c028f73-5024-4cc7-9729-793ef8cc12c8.filesusr.com/ugd/0a3240_e04448cca22f4931b38308244edf0784.pdf?index=true
    • https://c1133b46-203e-4111-b459-7233027e1a65.filesusr.com/ugd/361045_3617162b737540ca9295ba071d4110c7.pdf?index=true
    • https://3d67a098-c0ae-4be8-bcf2-240392da8e05.filesusr.com/ugd/1d3654_25d2e41e03a9453cb7c374de98c1a4b5.pdf?index=true
    • https://aaa084ce-f4c7-49ad-b77c-6fac80366d0c.filesusr.com/ugd/98857b_d72d8dc877d04e0a9d9653c2ecf7609e.pdf?index=true
    • https://12e2d1ca-fa4d-4a95-ab67-d12dc1b70cbf.filesusr.com/ugd/e643da_edc727337cae4fb19743300baca7eee1.pdf?index=true
    • https://bac5dcf1-2d2e-477a-b0d2-5162cf2a4682.filesusr.com/ugd/01bc73_ba8b21cc6f9b4075b8f2ab0da2f51443.pdf?index=true
    • https://7722fee4-dd47-48f0-ad67-9e179bb98479.filesusr.com/ugd/11b39a_6da1c5f19d0b402ca5b58b1c3cf05356.pdf?index=true
    • https://67813df8-52b7-46b2-b904-4fd5df5f4227.filesusr.com/ugd/3615fb_8ab42d6d36224a43b60b5fd5d73c96d2.pdf?index=true
    • https://f66afeca-8b59-4144-bcc0-8a93126347a5.filesusr.com/ugd/2f3216_20a4ef05d75c4a7a9aa3fa661463fe89.pdf?index=true
    • https://bca5612d-4a47-498f-9c72-d6aab9b25ac8.filesusr.com/ugd/5bb01c_91999761705a448095548d9027689b5a.pdf?index=true
    • https://12682549-346b-4b33-b32f-c759c95a882b.filesusr.com/ugd/40b9e6_a342c8f7a0e245d69d6d7e85be6a5c30.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000083bf.bin
f985d94dfdc2d89834e927f1cd97189fe19909ef43b995bb539858f75094e6f9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x83BF 5276 bytes
font_01_sfnt_off000095c7.bin
ae351e6928c36f77b4c239fcf3600bf1200f197ce2245d9840ca6fc92ec2943f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x95C7 11632 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.