Malicious PDF — malware analysis report

Static analysis result for SHA-256 2de1f0925d05c8c5…

MALICIOUS

PDF

42.1 KB Created: 2020-08-31 22:17:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: 22d29470789b281b227de14f69f966f0 SHA-1: d7d258d8a32df88da5fb48b2b82fdbf0c76e6fa9 SHA-256: 2de1f0925d05c8c54749198a4801632b3196ad34fcea69646ecec90869d6b178
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links, many pointing to benign Shopify URLs, but one critical link directs to a known malicious redirector. The ML classifier strongly flagged this PDF as malicious. The document body, though heavily obfuscated, contains the malicious URL and references to other PDF files, suggesting a link farm designed to obscure malicious intent and potentially distribute further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/pify?keyword=blasphemous+guide+steam In PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://cdn.shopify.com/s/files/1/0434/7727/0692/files/role_of_actuaries_in_insurance_sector.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0431/5725/8402/files/97191798470.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0431/9064/8996/files/xoxeruremowetaligevamafoz.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/64d889_1eed3f17a8f14a32aa06b0582f338e17.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/b8c837_f332d745aa2b48bc8a08515fda18557a.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/b8c837_41c9f0d5e1cc4f4baa542f3dbb10501a.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/b8c837_83f92be164bc406182a4d39472faeb79.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/b8c837_9204ea580f5f44c6bc5d9c83bcc08aba.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/ea9bdf_08e31b2576334b759a47b0061d7c5d92.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/38bf1f_c76202d56e5444c089368ed6ae656fa9.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/9e41f0_6036f593bde04033af8eb1d984d7abcf.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/2f3ac6_82cf668bbe8d461e88faf8b02d02e996.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0429/6366/5055/files/modelo_de_david_k_berlo.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0431/7131/5876/files/cracking_the_coding_interview_solutions.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0431/6371/3690/files/gewixetitor.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000067d1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x67D1 5328 bytes
SHA-256: 7d364e8877a46096c1523ae1d93b626f52b09f274a3569bf9f0432f495b95088
font_01_sfnt_off000079cd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x79CD 10076 bytes
SHA-256: d93fa1f651367541b8aaf3a8f377d4181b983334f14c1a50a94fbfa730025b60

Open this report in the interactive analyzer, or submit your own file for analysis.