Malicious PDF — malware analysis report

Static analysis result for SHA-256 28968f45b823133a…

MALICIOUS

PDF

58.7 KB Created: 2020-08-11 06:46:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1e1ccd6b2ff53623ea29c2ecb6dd0c76 SHA-1: 02657f473b7e0dd662242281657b2a7236c0aa8b SHA-256: 28968f45b823133a15f40fcf29bb7bce754ed32f72193a2930acd58b2f09614c
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a malicious link disguised as a download for an English grammar book. This link points to a known malicious redirector infrastructure, indicating a phishing or social engineering attempt. The ML classifier also strongly flagged this PDF as malicious. No scripts were extracted, but the primary attack vector is the embedded malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=class+5+english+grammar+book+pdf+download
    • http://rumukoz.manituokahasstudio.com/uploads/1/3/0/7/130776177/125985.pdf
    • http://files.bethelquesnel.net/uploads/1/3/1/6/131606262/1468909.pdf
    • http://files.thesoapshepherd.com/uploads/1/3/0/7/130740477/c2edf975.pdf
    • http://files.buzzsalonnorthfield.com/uploads/1/3/1/4/131483772/sulum.pdf
    • http://jifuluxu.ayorbyrobertosilva.com/uploads/1/3/1/3/131384635/jogekonav.pdf
    • https://cdn.shopify.com/s/files/1/0429/5625/9491/files/wisovagemukawata.pdf
    • https://cdn.shopify.com/s/files/1/0429/1005/6615/files/mileruxexorizegeko.pdf
    • https://cdn.shopify.com/s/files/1/0436/9140/9561/files/super_smash_bros_brawl_unlockable_characters.pdf
    • https://cdn.shopify.com/s/files/1/0430/0963/8553/files/tasetixojobamirawomagi.pdf
    • https://cdn.shopify.com/s/files/1/0430/2667/7913/files/watch_descendants_online.pdf
    • https://cdn.shopify.com/s/files/1/0427/5650/5756/files/subekefeponodasebomon.pdf
    • https://cdn.shopify.com/s/files/1/0431/5299/8556/files/nesuxogoxabafoponewefojek.pdf
    • https://cdn.shopify.com/s/files/1/0431/8524/2276/files/delukitifomogirifado.pdf
    • https://cdn.shopify.com/s/files/1/0431/4791/9522/files/jufuxudoxotunumedomu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007b5e.bin
88e07759a571c9edf88af2131113a444cd4bf8e07ac0dffdfad5eb195704cfe0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7B5E 5780 bytes
font_01_sfnt_off00008ed7.bin
8e3780bfbbaa2067a7d9418d404a565fd42c1203251c457ae8ba45e3c6fe022f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8ED7 6164 bytes
font_02_sfnt_off0000a00d.bin
f04318118b04dbd392e3743ccfdcae6049b839023a9abf202f299e2d81c59959		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA00D 10232 bytes
font_03_sfnt_off0000c32f.bin
c1e6ffc75750c5739b28184ea098192487e1c360ff13057a509a4a6bbbe05e79		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC32F 17492 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.