Malicious PDF — malware analysis report

Static analysis result for SHA-256 305a2dd674094282…

MALICIOUS

PDF

57.3 KB Created: 2020-08-10 07:11:26 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e75219a2d4bb7d740da87646fd769000 SHA-1: 448a9e4b37f24c439503b6d43f69ccae0e0b2c20 SHA-256: 305a2dd674094282019e4ab41a0c70cfe229b3b4409013ed01a2584ff01bbba5
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links, with one identified as a malicious redirector. The heuristic PDF_MALICIOUS_REDIRECTOR_LINK and PDF_SEO_LINK_FARM indicate that the document is designed to host numerous external links, likely for malicious purposes such as phishing or distributing further malware. The ML classifier also strongly flagged this PDF as malicious. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=sentido+arendtiano+de+la+banalidad+del+mal+pdf
    • http://files.maitriyogachester.com/uploads/1/3/0/8/130873807/vudober-godavidexexigix-napirotafopifu-nuxujokanowaf.pdf
    • http://files.powergymwear.com/uploads/1/3/1/3/131398547/9df20ad.pdf
    • http://files.milanarielleproductions.com/uploads/1/3/0/7/130739505/nosaletogaw.pdf
    • http://files.littlepaperslipper.com/uploads/1/3/0/7/130739783/rimejosezotid.pdf
    • http://files.dunbriste.com/uploads/1/3/0/9/130969758/duworotu-saxokubojuduzar-vakilasowibi.pdf
    • https://cdn.shopify.com/s/files/1/0433/5045/8520/files/lewovononapepigojofirug.pdf
    • https://cdn.shopify.com/s/files/1/0433/6739/9575/files/adobe_creative_cloud_cancel.pdf
    • https://cdn.shopify.com/s/files/1/0428/0867/2423/files/25406719791.pdf
    • https://cdn.shopify.com/s/files/1/0431/6564/7012/files/sample_tiff_file.pdf
    • https://cdn.shopify.com/s/files/1/0427/8353/9366/files/bifojikatekanavin.pdf
    • https://cdn.shopify.com/s/files/1/0435/8524/1256/files/nosuga.pdf
    • https://cdn.shopify.com/s/files/1/0431/6656/4503/files/xekun.pdf
    • https://cdn.shopify.com/s/files/1/0434/6344/2598/files/21756856529.pdf
    • https://cdn.shopify.com/s/files/1/0437/6841/4370/files/dagepitirevinejoli.pdf
    • https://cdn.shopify.com/s/files/1/0431/2858/6402/files/17512319208.pdf
    • https://cdn.shopify.com/s/files/1/0433/6871/0300/files/griddle_temp_for_pancakes.pdf
    • https://cdn.shopify.com/s/files/1/0432/9717/7768/files/ct_ghp_trang.pdf
    • https://cdn.shopify.com/s/files/1/0432/8043/3302/files/13070934815.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000091cf.bin
16d04d3700c0ef5cdfd4c8a7ff84bcbbcf0d0377a0c25ec12d0d2419cff8347e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x91CF 5040 bytes
font_01_sfnt_off0000a2c5.bin
498897c1e9eb4224cfe2dbca708074e2da73147052f713b3f44f6a7bb48b43c5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA2C5 11336 bytes
font_02_sfnt_off0000c797.bin
4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC797 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.