Malicious PDF — malware analysis report

Static analysis result for SHA-256 0bff3c400a6f4489…

MALICIOUS

PDF

46.0 KB Created: 2020-08-30 03:50:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e7af1b175ed8ee1d3f79e1b63e46e292 SHA-1: ca27120afbda5d19087f35a56a73bedbf12a0f10 SHA-256: 0bff3c400a6f4489589968543326c66ce77143d1da2fc777daf399684d26575c
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains numerous embedded links, with the primary one directing to a known malicious redirector. The ML classifier also strongly indicated maliciousness. The document body, though heavily obfuscated, contains the malicious URL and appears to be a lure related to a product review, suggesting a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=panasonic+sd-zb2502bxc+review
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://static.usrfiles.com/ugd/b8c837_bc438509ef674caf95ed813883331695.pdf
    • https://static.usrfiles.com/ugd/1cc7e8_6299e97498db41518fce42617831c91e.pdf
    • https://static.usrfiles.com/ugd/804ff6_9dd19388e861428cb00c50a4514ee276.pdf
    • https://static.usrfiles.com/ugd/e4ff69_0266b794a0274cf087296590ef1ffa18.pdf
    • https://static.usrfiles.com/ugd/b8c837_0c3950af51744499a95e42673eab7dd4.pdf
    • https://static.usrfiles.com/ugd/b8c837_a82f4c152217449f96f16aabdbc772ee.pdf
    • https://static.usrfiles.com/ugd/b8c837_74ae297ff93b4b328d2d254a0eeb62d5.pdf
    • https://static.usrfiles.com/ugd/b8c837_b7566470a67f4d2f9b2a0e6f8c7a8f65.pdf
    • https://static.usrfiles.com/ugd/fd3290_82c06af270a74346bba064e825c71bc6.pdf
    • https://static.usrfiles.com/ugd/b8c837_f3b86c16dfe740c0a94601885d5d65a7.pdf
    • https://static.usrfiles.com/ugd/0c41e7_c1ea09d5d6f346169494d316dbff49fc.pdf
    • https://static.usrfiles.com/ugd/79cb75_5389acacb4df4b348dfa49da0cecc962.pdf
    • https://static.usrfiles.com/ugd/b8c837_e2f482353dc9401d8619a086b667ae32.pdf
    • https://static.usrfiles.com/ugd/d54300_ffe2d156a432490eae06c02a0384fad7.pdf
    • https://static.usrfiles.com/ugd/b8c837_a0fd6ca95ad748b29772bbf24b52a278.pdf
    • https://cdn.shopify.com/s/files/1/0429/9830/0823/files/werajobowav.pdf
    • https://cdn.shopify.com/s/files/1/0456/8357/2895/files/ambersil_ipa_solvent_safety_data_sheet.pdf
    • https://cdn.shopify.com/s/files/1/0433/5062/2358/files/covey_matrix_template_word.pdf
    • https://cdn.shopify.com/s/files/1/0434/0783/5292/files/algebra_1_review_test.pdf
    • https://cdn.shopify.com/s/files/1/0441/0291/0104/files/dobubapesowapitivuzaxofe.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000735a.bin
4a8e4c0df04f7c816a60d4c0a70e21f23e19ab53b42b517c865fba5f578f87ed		 pdf-font-stream PDF embedded font (sfnt) at offset 0x735A 5744 bytes
font_01_sfnt_off00008716.bin
ae5f7ade325278228aebb9f22b93eaabbf2c8c4efdcdef1925ee838d815be911		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8716 10548 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.