Malicious PDF — malware analysis report

Static analysis result for SHA-256 087a66006bb7f7d2…

MALICIOUS

PDF

46.8 KB Created: 2020-08-14 10:33:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1ea4a79f1634addfd37aaa0dd0129887 SHA-1: 54f49bd0ef2bd18aff08e89d1759992c5d0fb321 SHA-256: 087a66006bb7f7d2bdeacdfeb23010f40d1bee041d54cdef4e482e4fdc19a2f3
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains numerous embedded links, with one identified as a malicious redirector. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of external PDF links, suggesting an attempt to create a link farm or distribute further malicious content. The ML classifier strongly flagged this PDF as malicious, supporting the conclusion that it is designed to lead users to harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=validity+formal+logic+definition
    • http://nikiki.outbackequines.com/uploads/1/3/2/6/132681066/wivovin_faposakak_rufiwurapet_pufetojurozani.pdf
    • http://files.talentrisecorp.com/uploads/1/3/0/7/130739227/f25304800d28.pdf
    • http://files.customer1stelectrics.com/uploads/1/3/1/6/131606360/446283.pdf
    • http://files.shoshonearts.com/uploads/1/3/1/8/131856380/rusudezan.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0431/7482/2044/files/25105254603.pdf
    • https://cdn.shopify.com/s/files/1/0431/5840/5275/files/12018842228.pdf
    • https://cdn.shopify.com/s/files/1/0447/0777/4618/files/hp_scanjet_5590.pdf
    • https://cdn.shopify.com/s/files/1/0431/3910/4917/files/suzefigizotegizosuw.pdf
    • https://cdn.shopify.com/s/files/1/0429/7677/2250/files/56295425644.pdf
    • https://cdn.shopify.com/s/files/1/0436/7751/5929/files/84572389177.pdf
    • https://cdn.shopify.com/s/files/1/0427/9359/9132/files/c_format_specifiers.pdf
    • https://cdn.shopify.com/s/files/1/0428/7873/0403/files/business_plan_pizza_restaurant.pdf
    • https://cdn.shopify.com/s/files/1/0435/9602/1919/files/atkins_physical_chemistry_9th_edition.pdf
    • https://cdn.shopify.com/s/files/1/0432/7469/8902/files/lorikazevesofowowowi.pdf
    • https://cdn.shopify.com/s/files/1/0437/2735/6056/files/28004987122.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000613a.bin
d3e2f9b95b397f855dd9d35fca26713c680d63543e1d18fd4a9e9f08ad87edac		 pdf-font-stream PDF embedded font (sfnt) at offset 0x613A 5228 bytes
font_01_sfnt_off000072f7.bin
b1afd3bf4a6196999026ac175562ab1e9342207cee73955938f774eabf7f0c93		 pdf-font-stream PDF embedded font (sfnt) at offset 0x72F7 10432 bytes
font_02_sfnt_off000096aa.bin
ae30e226a556fd8a33cbf3808d7fa8c4044c29860c01e95d7f28b80a77fb4fd5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x96AA 16544 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.