Malicious PDF — malware analysis report

Static analysis result for SHA-256 18e138472047554f…

MALICIOUS

PDF

108.3 KB Created: 2020-09-16 16:42:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: de909b8504e5672aeb06f6918a8d5543 SHA-1: d896c8e13dbaec17ded3706c857c514feb796934 SHA-256: 18e138472047554f641c945d58e7819eaf84106e732fd813e32986f0809f13f0
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded links, with one critical heuristic identifying a link to known malicious redirector infrastructure. The document body, though heavily obfuscated, contains text related to a 'visual guide' and a URL that appears to be a lure. The presence of many external links suggests a link farm or a method to distribute further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/wix?keyword=halo+4+the+essential+visual+guide
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0481/2737/7559/files/mapping_latitude_and_longitude_worksheet.pdf
    • https://cdn.shopify.com/s/files/1/0430/5377/7047/files/73585934416.pdf
    • https://cdn.shopify.com/s/files/1/0435/4975/3507/files/67358307616.pdf
    • https://9eacf6fb-d794-4875-abc0-25315a02d5da.filesusr.com/ugd/8e7730_4f63fadf501f4a8ebfa1acd086705855.pdf?index=true
    • https://e3b613ba-df4d-408a-8292-140f8d254465.filesusr.com/ugd/b90ba1_323858b15f6341f8885f8f87bea0affb.pdf?index=true
    • https://d8587937-b118-4ce1-93b4-b0fee345d0ee.filesusr.com/ugd/e3c460_5542462e4705497388a83862c3080b21.pdf?index=true
    • https://c5432876-cc0f-4b76-b2e9-0063b23c0177.filesusr.com/ugd/c6ac46_fd87faf54fae425eb0ae282862c34185.pdf?index=true
    • https://75c30be6-ec5f-4d74-8895-7e11a7054ade.filesusr.com/ugd/162fe6_0cb45a8990d444ea98e7b969e741253a.pdf?index=true
    • https://c998a909-3c9e-414e-bdb5-ea5d748d6de6.filesusr.com/ugd/e3ff21_c657ce867c0c4793b9ba47c65d8db486.pdf?index=true
    • https://8bad8734-bbae-453c-85ea-d094766a75c7.filesusr.com/ugd/bcc0e4_4efc72bcc52a458a92aef05a3539a595.pdf?index=true
    • https://f22f7d77-9a4c-445e-af12-5d9ab7d7e289.filesusr.com/ugd/3bf302_a670cc47c7ce4e1283ea3b3e77c7eeba.pdf?index=true
    • https://63b7931e-98d7-4d2a-92da-1d55c6475a3a.filesusr.com/ugd/1813b3_f563f833bfb1425c8217e782f3a09aa1.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00016b98.bin
dcc1ae4fc7b95cec6ad6c02b50688a5afd92dcad4806ebf175acc8e27b662e98		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16B98 5100 bytes
font_01_sfnt_off00017cfc.bin
253a8f9bd6f7fe8fdc1df2f4f83877ac13401ced3ecbdd6d12b7f7d3f12c7f9f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17CFC 11556 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.