Malicious PDF — malware analysis report

Static analysis result for SHA-256 0be3b2339e123352…

MALICIOUS

PDF

47.3 KB Created: 2020-09-18 12:09:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 48a47efc1bfcd04d24e6b333bb0ca37e SHA-1: 59d7826fc3f986bb6e85dcc3ff8d5cc21673ae9f SHA-256: 0be3b2339e123352b96f26777131f57228cae71fa4aa1af1857ff6e41734824c
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a large number of embedded links, with at least one pointing to a known malicious redirector. The ML classifier also strongly indicated maliciousness. The document body, though heavily obfuscated, contains URLs that are likely part of a link farm designed to attract traffic or distribute further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/wix?keyword=pronoun+shift+meaning
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://aee618cb-2dc4-4a5e-96a3-a783b38b5d37.filesusr.com/ugd/22739b_e59d177b9b544a839b020650dd831acc.pdf?index=true
    • https://bddec66a-e2cf-4c74-82f3-c4ccedd95153.filesusr.com/ugd/0af078_f37ae750104545328a322b99b32bb289.pdf?index=true
    • https://7fe856b7-e32f-45b2-8e3e-e4c6c79de442.filesusr.com/ugd/7d1dc9_ec6109c8f8324b779bdaab1c6bfb7ddd.pdf?index=true
    • https://6c94601a-4ed6-41e0-97e8-85e5cd8bf90e.filesusr.com/ugd/417718_53e89136250749c186bdb06cbe98dbec.pdf?index=true
    • https://9ce31253-2536-4970-a017-fb7b0f774a97.filesusr.com/ugd/d90490_752e1d71ae0c4403b1297ae65961cc33.pdf?index=true
    • https://03c6d5e6-3d6a-469a-bf5b-5457533244b9.filesusr.com/ugd/6a7407_4ad8c7679b4744b39556da10be7d9d09.pdf?index=true
    • https://1f3ab236-91cd-4bd6-b714-8bec883a64c2.filesusr.com/ugd/5e8de6_5e54be800b424a27a9b08ad63f587b3b.pdf?index=true
    • https://67f8f22e-7528-4b95-887f-25214d1e551c.filesusr.com/ugd/61804c_7f966bd2e3be458cb400adeff4dd1d2b.pdf?index=true
    • https://a1e2bd6c-8126-4f38-a568-aad6cbd586fb.filesusr.com/ugd/136d3d_04eb388d99dc4565a8759690ecfd37e2.pdf?index=true
    • https://cdn.shopify.com/s/files/1/0434/4751/7341/files/fuxupovawiwi.pdf
    • https://cdn.shopify.com/s/files/1/0434/6127/9894/files/xubuzowujoradogolotir.pdf
    • https://cdn.shopify.com/s/files/1/0431/2953/6676/files/validity_and_reliability_of_secondary_data.pdf
    • https://cdn.shopify.com/s/files/1/0436/0998/1085/files/mixed_mole_problems_chemistry_worksheet_answers.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/pitoparejiki.pdf
    • https://cdn.shopify.com/s/files/1/0435/2363/7402/files/manualidades_con_reciclados_para_vender.pdf
    • https://cdn.shopify.com/s/files/1/0439/1282/2952/files/30868647823.pdf
    • https://cdn.shopify.com/s/files/1/0434/2536/6165/files/gimudopirenekerosameg.pdf
    • https://cdn.shopify.com/s/files/1/0437/4773/7754/files/medida_da_altura_uterina.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006cec.bin
eef8ac4697d389cc0fe431e242f13250909cdbe294b795b2b1870185f887ae0c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6CEC 5032 bytes
font_01_sfnt_off00007dd2.bin
036da11dc9042257f102573863e7c6829e56c6ebc8f8d246baae0c3d4cba3cf3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7DD2 10636 bytes
font_02_sfnt_off0000a228.bin
d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA228 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.