Malicious PDF — malware analysis report

Static analysis result for SHA-256 1229d1f48298b5a3…

MALICIOUS

PDF

32.9 KB Created: 2020-09-17 09:01:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0a42296f0cb4ffa2cfbbf9c697fa22dc SHA-1: ba261fe89deb85d8602938e9f546e4c946803faf SHA-256: 1229d1f48298b5a38969987fcdc02e4737de7e36405aa6b57527849564f93ca2
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links, many of which point to known malicious redirector infrastructure or are part of a link farm designed to manipulate search engine results. The primary link directs users to a site that appears to be a malicious redirector, likely intended to deliver a second-stage payload or phish for credentials. The ML classifier strongly indicated maliciousness, supporting the heuristic findings.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=square+of+a+binomial+worksheet+kuta
    • http://files.hrdcommunications.com/uploads/1/3/1/4/131407708/gafigezoporadepafes.pdf
    • http://zokuwe.sportmednews.com/uploads/1/3/1/6/131606228/7f8e3eaf0.pdf
    • http://funexup.biblebelieversoflouisville.net/uploads/1/3/0/7/130739540/9802218.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://b049aabc-7903-4985-9ed9-9e36ccb8a591.filesusr.com/ugd/9757e7_fbff49bbf283495f98411b4984444dac.pdf?index=true
    • https://d2739ead-6aa6-49d4-b639-bdcd9691a26b.filesusr.com/ugd/011e4b_24e59915821a408eb5459ae5a94a6213.pdf?index=true
    • https://d8a7f42a-1285-4c99-9f58-fd558297921a.filesusr.com/ugd/e42c35_6afe911f4b2d418383573b2ccf33a1b0.pdf?index=true
    • https://aefbbdbb-7933-4922-a551-9d0da9b0b8e9.filesusr.com/ugd/0a052f_7790c3f865a445e4a2d47e72d965912f.pdf?index=true
    • https://cdn.shopify.com/s/files/1/0433/7578/8184/files/bookworms_oxford.pdf
    • https://cdn.shopify.com/s/files/1/0486/0677/3413/files/bleeding_steel_full_movie_in_tamil.pdf
    • https://cdn.shopify.com/s/files/1/0430/3772/0733/files/mabibuzim.pdf
    • https://cdn.shopify.com/s/files/1/0431/5915/8938/files/95342639865.pdf
    • https://cdn.shopify.com/s/files/1/0435/6397/4815/files/85752527328.pdf
    • https://238aac5e-f152-46d6-9966-611a2a77e034.filesusr.com/ugd/575fb0_d10f9bd7d50b47d7964be63cc5e56e61.pdf?index=true
    • https://e378b52a-0fad-4ca9-a45c-c8bf18f0d06f.filesusr.com/ugd/06497e_2f1af614061e41828ff7d83086e03a4e.pdf?index=true
    • https://467ce7b1-8c80-4d5f-a7e0-3d761e7fde0c.filesusr.com/ugd/1acd69_e7900e9b7bcf42109c3f332e49002df2.pdf?index=true
    • https://785ecc1e-cc6a-4243-8efc-85598889fdb0.filesusr.com/ugd/237bf7_49540846a39e4dfaaa730657f842cc1f.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004578.bin
fc67f7bbccda356fc029b7a97fa042d12f364cb4c729e2453bf6412539a3a1ad		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4578 5532 bytes
font_01_sfnt_off00005835.bin
58d69ac5ae02e8194ce322e501d48103594faa1faab93a60e030606ce965df86		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5835 8992 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.