Malicious PDF — malware analysis report

Static analysis result for SHA-256 2725ca338301cb51…

MALICIOUS

PDF

59.9 KB Created: 2020-08-03 17:43:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 054f40fcf5e3450162c17db4c49a74bd SHA-1: 56ff13504c9bd97e8279ca8a2008b9bcd4cb81ca SHA-256: 2725ca338301cb51b5c6b161746e00700e7b10428426bad4c56a32669e8f6e7b
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains numerous links, with one specifically identified as a malicious redirector. The document body, though partially corrupted, contains text suggesting a lure for a 'free download' which aligns with the observed malicious redirector. The ML classifier also strongly indicated maliciousness. The primary attack vector appears to be social engineering via a deceptive link within the PDF.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=integration+formula+pdf+free+download
    • http://files.midpacificowlrobotics.com/uploads/1/3/1/4/131406453/2985735.pdf
    • http://files.christianbuildingmaterials.com/uploads/1/3/2/7/132741089/wopurexime.pdf
    • http://wixuk.hadarsobol.com/uploads/1/3/0/8/130814017/bupiketa.pdf
    • https://cdn.shopify.com/s/files/1/0432/0234/7171/files/nipofafi.pdf
    • https://cdn.shopify.com/s/files/1/0430/7543/6698/files/housing_contract_purdue.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/kopamidije.pdf
    • https://cdn.shopify.com/s/files/1/0436/8033/3989/files/83602118175.pdf
    • https://cdn.shopify.com/s/files/1/0429/3964/6108/files/angular_resource_example.pdf
    • https://cdn.shopify.com/s/files/1/0436/4579/6512/files/tifetujofakipapozopil.pdf
    • https://cdn.shopify.com/s/files/1/0431/3622/1341/files/kexewapisopizijipitekej.pdf
    • https://cdn.shopify.com/s/files/1/0431/6351/7092/files/bimobemaxubumebodolupo.pdf
    • https://cdn.shopify.com/s/files/1/0433/3781/0075/files/besijupubesapaligese.pdf
    • https://cdn.shopify.com/s/files/1/0432/2865/9869/files/george_foreman_grill_manual.pdf
    • https://cdn.shopify.com/s/files/1/0432/7974/5192/files/42171670752.pdf
    • https://cdn.shopify.com/s/files/1/0431/8691/3439/files/nowivugarulegajuge.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000619e.bin
d34ba09c8924751cd5082a67b13b5eb8a19bbe922c564c334da93eda679e79af		 pdf-font-stream PDF embedded font (sfnt) at offset 0x619E 5212 bytes
font_01_sfnt_off00007356.bin
40ef96da86b6123d577d475be460de15c41b9ca7393a8e650be4e9942aa3c64b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7356 3720 bytes
font_02_sfnt_off00007eb8.bin
b847d3133e3f8a227364bde17fb5db48f09eba8fa10fd8768f216223729ecbe1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7EB8 14852 bytes
font_03_sfnt_off0000acf1.bin
b9ce2a69d7062e6ce176d2423fef49bcd955ad056a009dbf8258de8b57a023eb		 pdf-font-stream PDF embedded font (sfnt) at offset 0xACF1 16208 bytes
font_04_sfnt_off0000c269.bin
0d6534ee42a9b4c1a7da461405439b66d22f5b2fe92aa2a0ebe4968e6dd95abd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC269 8932 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.