Malicious PDF — malware analysis report

Static analysis result for SHA-256 0b48e331b218e79d…

MALICIOUS

PDF

67.8 KB Created: 2020-09-02 19:18:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ea30ed22fa9de1762fae67cd419279a6 SHA-1: d70845798dfac4a543afcdfaca1c325759bc4aa9 SHA-256: 0b48e331b218e79dacddc197c2014b8c2834b6e6ea9ed817ec3662aa77cd8c1e
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous links, with one identified as a malicious redirector. The document body, though heavily obfuscated, contains a URL that matches the malicious redirector found in the heuristics. This suggests the document is designed to lead users to malicious infrastructure, likely for further exploitation or phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=vre+bacteremia+treatment+guidelines
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://static.usrfiles.com/ugd/843280_29206c9776b047db8b289954492baecd.pdf
    • https://static.usrfiles.com/ugd/63022f_0287aaabc3ce44f6896637e42eae9515.pdf
    • https://static.usrfiles.com/ugd/97634b_32230f7e96754b97a986033b5e89f8a3.pdf
    • https://static.usrfiles.com/ugd/e5412a_078c0bd325cf4b8fa1bea77b627689b8.pdf
    • https://static.usrfiles.com/ugd/26938b_307968050e144529b5a3592b23e227f9.pdf
    • https://static.usrfiles.com/ugd/7e0eb0_551dcea95ae54626ac6fd78aeb849277.pdf
    • https://static.usrfiles.com/ugd/c722c2_e529f9e6de2e4e70a0568617629098f8.pdf
    • https://static.usrfiles.com/ugd/762c1a_8037e56a67e340f7a261da96c835f571.pdf
    • https://static.usrfiles.com/ugd/ca32a8_58306048319f4b20a63eb5d5ec6501b1.pdf
    • https://static.usrfiles.com/ugd/b8c837_14528a42e0e348f6a6ba60112970bfb4.pdf
    • https://cdn.shopify.com/s/files/1/0447/3618/4474/files/gentleman_s_guide_original_cast.pdf
    • https://cdn.shopify.com/s/files/1/0437/5327/5546/files/3d_animation_maker_apk_game.pdf
    • https://cdn.shopify.com/s/files/1/0432/7568/1947/files/adventure_island_game_free.pdf
    • https://cdn.shopify.com/s/files/1/0437/1588/7256/files/vigenewixetile.pdf
    • https://cdn.shopify.com/s/files/1/0437/9534/9661/files/dkny_dress_size_guide.pdf
    • https://static.usrfiles.com/ugd/b88e3d_0bac628a97e440c4885180374254e5d8.pdf
    • https://static.usrfiles.com/ugd/c8a981_6604fed7eab04f598c87be164e5e839f.pdf
    • https://static.usrfiles.com/ugd/a2ebd8_a21d7dd80bcc46f1855130a608ab03e3.pdf
    • https://static.usrfiles.com/ugd/79e0dc_483e8438da8d4608be7b3b9946ba73f2.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c5f4.bin
7542bc4b9c256e7585882b92c30334611ba5e91cc463e35fbba6eca734d49906		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC5F4 5364 bytes
font_01_sfnt_off0000d818.bin
6cacc28a143e05c379c9f761cdbfd6edff2975f5d5c9b9eebd1b8a3681751a05		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD818 12952 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.