Malicious PDF — malware analysis report

Static analysis result for SHA-256 10c614704b7c56f2…

MALICIOUS

PDF

69.2 KB Created: 2020-09-01 04:10:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 714f5cae93290194d8f647d44bf49f04 SHA-1: 1240fc1037bda339d7c3a94bd12b610f3865f4e3 SHA-256: 10c614704b7c56f2c90d3639ee5c3bd010fc092ee22027565cb345825e87bfb0
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous links to external resources, with one identified as a malicious redirector. The document body, though obfuscated, suggests a lure related to financial statements. The presence of multiple links to PDF files hosted on various platforms indicates a link farm designed to distribute malicious content or engage in SEO manipulation for phishing purposes. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=balance+sheet+in+arabic+and+english
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://static.usrfiles.com/ugd/b8c837_3817d52ff11649bc92c5abae18723297.pdf
    • https://static.usrfiles.com/ugd/6cfc61_11ff6a76a65f4d85916fac66feee414e.pdf
    • https://static.usrfiles.com/ugd/cb4a18_4c761be07dc64347a5edbe6c7c269a35.pdf
    • https://static.usrfiles.com/ugd/10b11f_04afe87fd3cb4a208c6c7bbae3d3568e.pdf
    • https://cdn.shopify.com/s/files/1/0429/2381/9175/files/65742440034.pdf
    • https://cdn.shopify.com/s/files/1/0436/1102/9666/files/sexoribata.pdf
    • https://cdn.shopify.com/s/files/1/0432/3462/3643/files/parosutejugilufe.pdf
    • https://cdn.shopify.com/s/files/1/0432/9183/6566/files/67355398362.pdf
    • https://cdn.shopify.com/s/files/1/0429/4131/7276/files/nuwujavijizifalege.pdf
    • https://cdn.shopify.com/s/files/1/0436/8482/3205/files/rugarli_cardiologia.pdf
    • https://cdn.shopify.com/s/files/1/0435/8694/5187/files/sensory_details_chart.pdf
    • https://cdn.shopify.com/s/files/1/0435/3880/8991/files/loan_payment_promissory_note_template.pdf
    • https://cdn.shopify.com/s/files/1/0464/7210/2056/files/55131686661.pdf
    • https://cdn.shopify.com/s/files/1/0437/3427/0117/files/zozesufa.pdf
    • https://cdn.shopify.com/s/files/1/0434/2788/9319/files/kasatifekigopa.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_006_off0000cf8d.bin
2927be1146660d7c73e5c1ac7c6ef0cb8dade9e0e93344b4ed7c2125f9d27f8f		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xCF8D 31644 bytes
font_00_sfnt_off00009aed.bin
df19013d76850d4acafb131b34fb0f86f67b54670aae4fdb2bc19750d5d9faee		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9AED 5388 bytes
font_01_sfnt_off0000ad31.bin
b0d3cf6e2812c6f125006a4f6d9c9e08992fe93069fde2f58a918e543de8d6e2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAD31 9984 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.