Malicious PDF — malware analysis report

Static analysis result for SHA-256 1c2b100749251fcd…

MALICIOUS

PDF

48.7 KB Created: 2020-09-17 21:32:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ae528a0af68c624091856a987831ad97 SHA-1: 6420bc237b636eb9f27a7bcd6007f0c7e16e0d25 SHA-256: 1c2b100749251fcd283acec4127ad4b03e1212b8ec37259505a07f88ae640cab
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a link farm designed to appear as legitimate educational resources, but it redirects to a malicious URL. The ML classifier strongly indicated maliciousness. The primary malicious IOC is the redirector URL, which is used to funnel victims to further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/wix?keyword=elementary+principles+of+chemical+processes+3rd+edition+solutions+pdf
    • https://587a89e9-cfdf-4958-b71f-409516071fa1.filesusr.com/ugd/7ba596_d3136ea3c0614a269ee054c86d37c104.pdf?index=true
    • https://d2b41cb5-87af-4668-a4d9-fc7cfc0aa983.filesusr.com/ugd/de3d83_af2316d4e0454689adb88bab7229d8d4.pdf?index=true
    • https://d6e432f2-4f5c-42f2-a0e0-ce32949db23e.filesusr.com/ugd/4f270c_d40f5b6574a14ea4a69e9a17f718e70b.pdf?index=true
    • https://cdn.shopify.com/s/files/1/0440/7413/9813/files/26545861212.pdf
    • https://cdn.shopify.com/s/files/1/0428/6880/1702/files/90208072115.pdf
    • https://cdn.shopify.com/s/files/1/0427/9920/2467/files/56552858694.pdf
    • https://cdn.shopify.com/s/files/1/0434/3853/8904/files/zotofemalem.pdf
    • https://e8ff8510-d58d-462c-8adc-d842972ccd8f.filesusr.com/ugd/b58d21_6e194bba47c247e89e014ea831689d06.pdf?index=true
    • https://505e28fa-a390-4400-94ed-340fed0af414.filesusr.com/ugd/850f07_8dea679962294ed78c9af5a48ed68ce2.pdf?index=true
    • https://3c3664dc-c505-4054-9246-fa7097bfd5d8.filesusr.com/ugd/45fd81_3331c155f86640b4ad7677eb378cced2.pdf?index=true
    • https://9bcc4dec-c201-42dc-9771-af79c45e28b8.filesusr.com/ugd/9f06f8_0999615163d34bc5ac75752843eeb6bf.pdf?index=true
    • https://273a9602-0f4a-479c-a89a-812a741fd839.filesusr.com/ugd/529dbf_83d08c21399946a18938f073f76e236c.pdf?index=true
    • https://01c237ed-69a3-4f6c-b0b0-381a38a89394.filesusr.com/ugd/f3cb45_e7174537c80640b8b03b1361ff11f706.pdf?index=true
    • https://1dcfca7b-ea10-4fdf-bb06-4c5c542ae363.filesusr.com/ugd/c162b3_5ef7cf8675284a429dd3b3e4798f4739.pdf?index=true
    • https://d3512314-0a3d-4b19-b85d-0cf7d3d214a5.filesusr.com/ugd/738632_12c8c7bdf9064c62ba84114e036820b6.pdf?index=true
    • https://a684e87b-1e09-470d-8ae2-9daf199ad086.filesusr.com/ugd/fdee49_96e1b4e225714680ad2b8b234fa2e497.pdf?index=true
    • https://b6346132-eb87-4307-9f45-fde248d5e192.filesusr.com/ugd/8a4248_c0ddafa659674ef08d0a8a30108ac285.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://1dcfca7b-ea10-4fdf-bb06-4c5c542ae363.filesusr.com/ugd/c162b3_5ef7cf86752

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006989.bin
19602a3bbdde554616127a892709a3a22408813a1dc17a41a7ba5f15d097a9b6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6989 5620 bytes
font_01_sfnt_off00007c7f.bin
e3fcfe98fe6389bf413b9fb448fa08a4009712a7cbe77afc94489df4142f9681		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7C7F 10256 bytes
font_02_sfnt_off00009fe4.bin
06514985949027998cb069cac656318875dfb01ceaa7b201620f0295f45dc01f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9FE4 16096 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.