Malicious PDF — malware analysis report

Static analysis result for SHA-256 07bd05713c12fc2d…

MALICIOUS

PDF

41.5 KB Created: 2020-08-30 14:44:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bf5ba0139eeb0c9f8dea0ef9ba96eb6f SHA-1: 98a228ba21b760f1ed4e28f66fd9d91af9ba6126 SHA-256: 07bd05713c12fc2d6c1a13077d3b2a5a929730879746dc63396efdf497860622
162 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains embedded links, with one specifically identified as a malicious redirector. The document body, though heavily obfuscated, appears to be a 'job search log sheet' which, combined with the 'urgency lure' heuristic, suggests a phishing attempt. The presence of numerous external PDF links further indicates a link farm designed to obscure the ultimate destination, likely a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=job+search+log+sheet
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://static.usrfiles.com/ugd/1cc7e8_b5d5864820da40c18263b6442a2fa3c0.pdf
    • https://static.usrfiles.com/ugd/764aaa_bf034b25c0ea4def93e1c70e5cc15181.pdf
    • https://static.usrfiles.com/ugd/c1108c_5913b379fdf5465794164e69c7d93a9c.pdf
    • https://static.usrfiles.com/ugd/d162e3_c03b181481ab47b980a938da8da55369.pdf
    • https://static.usrfiles.com/ugd/dd4472_187147a12f2148a7a14c5a0e7443b8c1.pdf
    • https://static.usrfiles.com/ugd/b8c837_312504d1cf2d44fcb4f3b3d8e2ce6d74.pdf
    • https://static.usrfiles.com/ugd/c7a620_16b5d93a19e5429a81069da8358aac08.pdf
    • https://static.usrfiles.com/ugd/b8c837_7046c48c428e4ba9b66b01ef9ae738b3.pdf
    • https://static.usrfiles.com/ugd/2f3ac6_ada0539f3af946a8949de02e4053f3fa.pdf
    • https://static.usrfiles.com/ugd/7ff653_31d62ba3a3d84dc196866d003a1b3212.pdf
    • https://cdn.shopify.com/s/files/1/0430/3588/5725/files/49983224119.pdf
    • https://cdn.shopify.com/s/files/1/0447/1855/5292/files/bug_out_bag_gear_list.pdf
    • https://cdn.shopify.com/s/files/1/0440/2076/0734/files/54769934069.pdf
    • https://static.usrfiles.com/ugd/9904c2_acd739548ee14540902c022fe46ea03f.pdf
    • https://static.usrfiles.com/ugd/dd4472_a4e7417fcacc4ab4a5417c9ea6253d68.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000064c6.bin
0cd78a2fe3a253ade907195d45c822828ab15dfab4e5b919d67c14d8ee78ba1d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x64C6 5192 bytes
font_01_sfnt_off00007661.bin
1cf24d049d2c2952f5cd1e4cf0eaf06bb4bfef53e81fa9676329cafeff9255ef		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7661 10308 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.