Malicious PDF — malware analysis report

Static analysis result for SHA-256 12f79924a96f68b3…

MALICIOUS

PDF

46.3 KB Created: 2020-09-01 16:04:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 16a9bc0f8c3cbe192067f394a59b42bb SHA-1: 1e5739334bdee244ebf0e599d11bc00a0f3eb9fc SHA-256: 12f79924a96f68b3a236d347cd0071427a65253d5ea5dfe6a438c820b9f92b89
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded links, with one identified as a malicious redirector. The document body, though heavily obfuscated, contains text that appears to be a song title, suggesting a lure to drive traffic to the malicious URL. The presence of many external PDF links further indicates a link farm or SEO spamming attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=bairavaa+tamil+cut+song
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://static.usrfiles.com/ugd/20d83a_6d3d115e2266420a88a78c7fe35268de.pdf
    • https://static.usrfiles.com/ugd/b8c837_559675a73b904d7ba612f4eb3e05f2b7.pdf
    • https://static.usrfiles.com/ugd/edb4a7_5755977548af4287b35f7b35a35b3f09.pdf
    • https://static.usrfiles.com/ugd/f6a907_6b7d3ab1ba9945beaf3375cd52652a58.pdf
    • https://static.usrfiles.com/ugd/7a11b0_5753bbffcb8f49239203a377ab32678a.pdf
    • https://static.usrfiles.com/ugd/12f4eb_8cc945eae7e341cda122e7e699a392ce.pdf
    • https://static.usrfiles.com/ugd/97aff7_26ae3dd6fe3d4a35b991653b5d711998.pdf
    • https://static.usrfiles.com/ugd/3eed2b_3c574cadfe6c4adcbf863c24864da8ba.pdf
    • https://static.usrfiles.com/ugd/6d59ab_5a7934fa78584e47a6486172e5347baa.pdf
    • https://static.usrfiles.com/ugd/accd1f_ee1fc4bfd6f6481c9fa5483c34fa7076.pdf
    • https://static.usrfiles.com/ugd/b42fd6_69290d75bf5f48eca992c5a75de04187.pdf
    • https://static.usrfiles.com/ugd/c1c462_4b70b44daac04320a97738af2822ffe7.pdf
    • https://static.usrfiles.com/ugd/b8c837_28659cd01f1f4b75b434e49e3ee1b8be.pdf
    • https://static.usrfiles.com/ugd/7f929b_f6eea90bcb894a9e917269126fe1b5bc.pdf
    • https://static.usrfiles.com/ugd/19ce5d_2fac15ee8f6c4d4895b42b0f45539d9b.pdf
    • https://static.usrfiles.com/ugd/9ff9b8_57a6299bb2df4e1ebda2b5f9e3f082c2.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off0000551b.bin
6ec219a466b506b721e50cf9e8fe97180ed7ced18990aa9c00ff7e6d3d7fd85a		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x551B 7436 bytes
font_01_sfnt_off00006e23.bin
3dc5edb3b480301c4651a8835f99905a104945925935fcb2473f2ec377db7df1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6E23 5228 bytes
font_02_sfnt_off00007fde.bin
cb3ccdee41f6c244da842074867342780ef20ba32e6045fb39233e065eb2a30d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7FDE 13528 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.