Malicious PDF — malware analysis report

Static analysis result for SHA-256 0a45e4f11c5da48e…

MALICIOUS

PDF

49.7 KB Created: 2020-08-12 14:50:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 40a98786acf6753d95d36c93d13f7876 SHA-1: 6af1ee8a053bde21665a96c92e0a6b470fe2d18e SHA-256: 0a45e4f11c5da48ee601b4933fdda3a8dda6a0f87a6c4da02546e782370c58e9
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links, with the primary URL pointing to known malicious redirector infrastructure. The ML classifier also strongly indicated maliciousness. While no scripts were extracted, the sheer volume of links suggests an attempt to lure users to malicious sites, potentially for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=ashokan+farewell+tab+pdf
    • http://files.snaptoitstaging.com/uploads/1/3/0/7/130776712/6239320.pdf
    • http://pibubino.riversidecoc.net/uploads/1/3/1/3/131380213/1984678.pdf
    • http://files.rvlifefromtoptobottom.com/uploads/1/3/2/8/132814967/da478690a.pdf
    • http://files.lightindarknessohr.org/uploads/1/3/0/7/130776031/bbf2df8.pdf
    • http://melibu.drewhooverphotography.drewhoover.com/uploads/1/3/0/7/130740178/lotet.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0433/5095/0041/files/68240796034.pdf
    • https://cdn.shopify.com/s/files/1/0437/6271/2734/files/applied_linguistics_definition.pdf
    • https://cdn.shopify.com/s/files/1/0430/3332/9815/files/nexevonotikurafanu.pdf
    • https://cdn.shopify.com/s/files/1/0429/9803/8679/files/37903879595.pdf
    • https://cdn.shopify.com/s/files/1/0435/7442/7809/files/52392447307.pdf
    • https://cdn.shopify.com/s/files/1/0432/4104/6171/files/27560730039.pdf
    • https://cdn.shopify.com/s/files/1/0437/2329/2840/files/28708925376.pdf
    • https://cdn.shopify.com/s/files/1/0435/3861/2378/files/dekubulerewobog.pdf
    • https://cdn.shopify.com/s/files/1/0430/5901/9927/files/elton_john_daniel.pdf
    • https://cdn.shopify.com/s/files/1/0437/1959/0040/files/risk_board_game_rules_2020.pdf
    • https://cdn.shopify.com/s/files/1/0433/3453/3275/files/jefunutufabozijunaz.pdf
    • https://cdn.shopify.com/s/files/1/0437/8312/7201/files/28487791929.pdf
    • https://cdn.shopify.com/s/files/1/0431/5018/0503/files/3308052196.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000074ae.bin
a86df4b8cfb18c9b434e085b68b572e4f5b4a9f7ad8f7d32c5a4e430c8b8e13f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x74AE 5412 bytes
font_01_sfnt_off00008716.bin
f0084ca96ec4e8d7911537e48a7c7821e7ef00b8c193f124f477ba1d94ef2cc1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8716 15644 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.