Malicious PDF — malware analysis report

Static analysis result for SHA-256 10633bf248c29ecc…

MALICIOUS

PDF

45.1 KB Created: 2020-09-15 21:42:17 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 19d7e77defca380f321009fdabbbedb8 SHA-1: 091256b52d78c082a8044f9dd87bbb24629bf8a0 SHA-256: 10633bf248c29eccc294bfb5f7b106b402191f1af0a5199b028860137768e241
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded links, with one identified as a malicious redirector. The document body, though heavily obfuscated, contains text suggesting it is a lure for educational materials, likely to trick users into clicking the malicious links. The presence of multiple external links and a redirector suggests an attempt to lead the user to a malicious site or download further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/pify?keyword=core+connections+algebra+volume+2+chapter+9+answers
    • http://files.givegmc.com/uploads/1/3/2/6/132695663/titupe.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://static.usrfiles.com/ugd/868401_8c352f85ba764a9bafb3ebcad7b14ef1.pdf
    • https://static.usrfiles.com/ugd/5b9365_9660f80bb0e44de8ad36f0e15888301d.pdf
    • https://static.usrfiles.com/ugd/df4650_fac9f97eae4f4c6bae4072218637d749.pdf
    • https://static.usrfiles.com/ugd/7ef0dc_0ed630279de74b498b785afa76c6e63a.pdf
    • https://static.usrfiles.com/ugd/e4ff69_41125c5bdf7e4972bc93339ae5765187.pdf
    • https://static.usrfiles.com/ugd/c3f59f_32b605185fd04050bb3f33909d9614f9.pdf
    • https://static.usrfiles.com/ugd/08fe48_52aec3e238ca4bbd801a6e3c7669b0ef.pdf
    • https://static.usrfiles.com/ugd/964009_0282056d707a4c6db0372c1c2728c158.pdf
    • https://static.usrfiles.com/ugd/e2b09b_c00d50d1412e42d085feb7551a970a4d.pdf
    • https://static.usrfiles.com/ugd/5de1df_d796a610676b47428c9a4c944de99d7c.pdf
    • https://static.usrfiles.com/ugd/e8e253_0bcf51330bbd42bb9473aeb1f77386a1.pdf
    • https://static.usrfiles.com/ugd/5f226b_86d56438c0784f49a3eae08ea3822b12.pdf
    • https://static.usrfiles.com/ugd/9d24cb_4c963c9b2b4e43f6bc677e1d9b50f33a.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005a3a.bin
27db356d01e5e826de83aee4c777ed81429f884ab3c802be9ac23605f6fdcc22		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5A3A 5832 bytes
font_01_sfnt_off00006df8.bin
5fdd1d0419757de0d057bbf92610a611ea00560186921efd5c44cdab958ed041		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6DF8 10600 bytes
font_02_sfnt_off0000922e.bin
6f31d8a09968cb758392806dff4ce0e2643fc3d6dc332c5b9fa07753cf63feee		 pdf-font-stream PDF embedded font (sfnt) at offset 0x922E 16076 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.