Malicious PDF — malware analysis report

Static analysis result for SHA-256 2542406a2b1563ad…

MALICIOUS

PDF

90.1 KB Created: 2020-08-30 14:25:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 02c8181cc6dc47a70c9280b32f69bf6e SHA-1: 5a4a6ffff07a2bd43ab5d5c9a19e96dc83c3e43f SHA-256: 2542406a2b1563ad78d9f5862925410db05827df16818649e3f4f5de5b742aaa
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a critical heuristic firing indicating it links to known malicious redirector infrastructure. The document body, though heavily obfuscated, contains text suggesting it is a 'guide pdf free download' and includes the suspicious URL. This indicates a social engineering attempt to trick users into visiting a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=10th+tamil+james+guide+pdf+free+download
    • https://cdn.shopify.com/s/files/1/0433/2086/9019/files/nazemazigosin.pdf
    • https://cdn.shopify.com/s/files/1/0427/6633/6167/files/ziwobe.pdf
    • https://cdn.shopify.com/s/files/1/0427/9818/6652/files/zigikelogamapinotobod.pdf
    • https://cdn.shopify.com/s/files/1/0463/2038/6205/files/best_manager_for_chrome_windows_10.pdf
    • https://cdn.shopify.com/s/files/1/0435/9022/1983/files/food_chain_worksheet_kindergarten.pdf
    • https://cdn.shopify.com/s/files/1/0434/6229/5714/files/madegamumizibixaxenolexof.pdf
    • https://cdn.shopify.com/s/files/1/0439/0027/2792/files/xumadigapovolut.pdf
    • https://cdn.shopify.com/s/files/1/0458/1418/6150/files/2016_chevy_spark_ls_manual.pdf
    • https://cdn.shopify.com/s/files/1/0431/5735/6710/files/jodekowus.pdf
    • https://cdn.shopify.com/s/files/1/0427/9740/0223/files/1745742138.pdf
    • https://static.usrfiles.com/ugd/b8c837_0cb9697d668544eeb092137be2196908.pdf
    • https://static.usrfiles.com/ugd/b8c837_4ad506e16d354203ab18ad88794e9d11.pdf
    • https://static.usrfiles.com/ugd/6908d7_33351d22fe2441ae81c43a862ec63a74.pdf
    • https://static.usrfiles.com/ugd/f4de5e_ed8c1c6013fe4a4abde136c212725312.pdf
    • https://static.usrfiles.com/ugd/b8c837_9cf11d6e09b942f1bdaa67affebb8366.pdf
    • https://static.usrfiles.com/ugd/5ecadc_9fe672ecaf3b473b9efacf40f6f05199.pdf
    • https://static.usrfiles.com/ugd/b8c837_cd8cb8e1c4cd4295b0317805ad0c1e85.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_005_off0000f2bf.bin
a6f14984fcb5f06b4982468d31be8b7f1b6126456bd3bca69fe0625f03c4a59a		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xF2BF 20192 bytes
font_00_sfnt_off0000df55.bin
3745a19806e4c498ce5e28c2138159deeeab519284aeb1210bfae4423906dced		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDF55 5720 bytes
font_02_sfnt_off00011e48.bin
3f3a3bda59b8128a72ddfe095e5f3258715b8968e134b0380d538738068fea1d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11E48 1944 bytes
font_03_sfnt_off00012793.bin
8f4d4cd0dafe24ddd46ac5dc8a69b9547d1aece52a19255ade4ea51dd6c1c6a4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12793 11288 bytes
font_04_sfnt_off00014c59.bin
d7a1248cabf161ff78a072bd924b98f1b4e551660f4e151c9433689786990c0c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14C59 2832 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.