Malicious PDF — malware analysis report

Static analysis result for SHA-256 0e0748bd7d8ad6e2…

MALICIOUS

PDF

54.6 KB Created: 2020-09-08 18:47:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f8d891941854de622a1a575e8db04724 SHA-1: 3546a6f64a1c76c43755593010de4d198f9f3d43 SHA-256: 0e0748bd7d8ad6e299efc1be35a8733a8158b12c329950f4968ab89091a4b66e
194 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF contains numerous external links, with one identified as a malicious redirector. The heuristic 'SE_ADVANCE_FEE_SCAM_LURE' indicates the document's content is designed to trick users into a financial scam. The ML classifier strongly flagged this PDF as malicious, and the presence of embedded URLs suggests an attempt to direct users to malicious infrastructure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/wix?keyword=university+of+virginia+mba+employment+report
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://static.usrfiles.com/ugd/fb41f9_b9f395f9a5e44c7f956b4614f1ea2408.pdf
    • https://static.usrfiles.com/ugd/5c139a_598730884dfe4a8183d3ccec61267891.pdf
    • https://static.usrfiles.com/ugd/f65518_b5fe720a47fe4a23af537e8c74a100dd.pdf
    • https://static.usrfiles.com/ugd/8dde66_d4bfc70e31ed4848b036079782a3db93.pdf
    • https://static.usrfiles.com/ugd/906e9f_c5fcecda748d4020ae99c05e493efd34.pdf
    • https://cdn.shopify.com/s/files/1/0433/5396/4712/files/sonotamuv.pdf
    • https://cdn.shopify.com/s/files/1/0429/2096/8358/files/chest_and_biceps_workout_videos.pdf
    • https://cdn.shopify.com/s/files/1/0428/0591/9903/files/xenedexujifokugebo.pdf
    • https://cdn.shopify.com/s/files/1/0430/7589/5447/files/anaconda_3_tamil_dubbed_movie_hd.pdf
    • https://static.usrfiles.com/ugd/b1dabf_caf2641685904308be8fa0a839ac5c9b.pdf
    • https://static.usrfiles.com/ugd/18ee90_75589f93a4884f04b51312831f90058c.pdf
    • https://static.usrfiles.com/ugd/4c4e45_481c6f2c201a4893827cbc2189a63459.pdf
    • https://static.usrfiles.com/ugd/906e9f_b7cac3587ffe457982d5a38b4037674f.pdf
    • https://static.usrfiles.com/ugd/5ecadc_a4506268b5684a51852a83703ab70db4.pdf
    • https://static.usrfiles.com/ugd/f80014_603b59edb2394886ae4ad055a0beb0da.pdf
    • https://static.usrfiles.com/ugd/3ab5ed_27d6c9a4f78e46febcce9ea6adc2a74e.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000912e.bin
0efcdbb3a6d485b165bb38f529606f5aa9c3965f7db7af3449f87aeeaf4cf00c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x912E 5512 bytes
font_01_sfnt_off0000a3e7.bin
6788c406b7739d38c28619a9ffbd62ae3e801e5d16265306b13cb960f1da0edd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA3E7 12576 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.