Malicious PDF — malware analysis report

Static analysis result for SHA-256 0f23a99a52b6e5e7…

MALICIOUS

PDF

50.5 KB Created: 2020-08-30 13:33:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 11ac5edc819292477969f528e5e67893 SHA-1: 487b474a0999874c9b15276983621e71b2b1cf43 SHA-256: 0f23a99a52b6e5e7cedcec07db2d11f8aafb1e3b547e470ac58e871c7f3ae9e2
194 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file contains numerous embedded links, with one pointing to a known malicious redirector. The document body, though heavily obfuscated, appears to contain text related to a high-value item ('Alienware area 51m 15x') alongside URLs, suggesting a lure for an advance-fee scam. The presence of a link farm and a malicious redirector indicates an attempt to lead the user to malicious infrastructure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=alienware+area+51m+15x
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://static.usrfiles.com/ugd/6cf392_56dd8c4624b5443b9f2dab2f5c0d8a43.pdf
    • https://static.usrfiles.com/ugd/b8c837_2fa5e19c3e874ab1a8b08aba72e3ba99.pdf
    • https://static.usrfiles.com/ugd/ab922d_1e88895fd54e46e7ada75ffa86061003.pdf
    • https://static.usrfiles.com/ugd/2ac701_d27e151a6b014b1fb480b8ab1e65f7f1.pdf
    • https://cdn.shopify.com/s/files/1/0430/7510/9018/files/73703936203.pdf
    • https://cdn.shopify.com/s/files/1/0437/7929/3338/files/zulojideziwedebevokemafum.pdf
    • https://static.usrfiles.com/ugd/8cbfce_b975deea49264893a40c03a9ef7c3449.pdf
    • https://static.usrfiles.com/ugd/f65518_a9bf1a35797f4d3bbbd2fbba14372236.pdf
    • https://static.usrfiles.com/ugd/12dc78_ba26325166854c3a9813ed92112dfd31.pdf
    • https://static.usrfiles.com/ugd/b8c837_71579a2e973a4942a47c4e245a47f217.pdf
    • https://static.usrfiles.com/ugd/b98abb_28c3abd2212e416e952190ae9a508dbe.pdf
    • https://cdn.shopify.com/s/files/1/0431/2036/1629/files/anamnesis_fisioterapia.pdf
    • https://cdn.shopify.com/s/files/1/0428/1224/4134/files/mekimowetomedakonej.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000805f.bin
b9c12308464e00f7893517f8ed80ad1b784973a3bbfe8227f06c9e9bc4ab43e8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x805F 4980 bytes
font_01_sfnt_off00009153.bin
70c9a8c14290112392d398c03ab6a8d0abf6fcf4605bfe173464aac1964f1055		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9153 13992 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.