Malicious PDF — malware analysis report

Static analysis result for SHA-256 30ea641193ddab93…

MALICIOUS

PDF

43.3 KB Created: 2020-08-05 12:25:19 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c79f6d68707e35675d7a0ade1efa14f2 SHA-1: 7b40e9d592c5357f66e29447760f494989da26e1 SHA-256: 30ea641193ddab93b6bfc98e70486a3670da079e75025cb69c19704994cc7462
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document exhibits characteristics of a link farm or SEO manipulation, with numerous embedded links pointing to external PDF files. One of these links, 'https://ttraff.cc/pify?keyword=mathematical+economics+simon+blume+pdf', is identified as a redirector to known malicious infrastructure. The ML classifier also strongly indicated maliciousness. No scripts were extracted, and the document body contained mostly binary data and metadata, making the attack pattern primarily based on the link structure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=mathematical+economics+simon+blume+pdf
    • http://files.protegeedu.com/uploads/1/3/1/3/131379246/pitufubalovojojebato.pdf
    • http://files.concordanimalhospital.com/uploads/1/3/2/7/132710690/6759545.pdf
    • http://files.qmotionfabrication.net/uploads/1/3/1/3/131397955/vexikefaful.pdf
    • http://files.tworiversrecovery.com/uploads/1/3/2/7/132740860/91cf8adff.pdf
    • http://files.rockymountainluxepuffpoodles.com/uploads/1/3/0/8/130874588/tovazuwewaduzez.pdf
    • https://cdn.shopify.com/s/files/1/0434/9411/3446/files/gutokiwoxojufoj.pdf
    • https://cdn.shopify.com/s/files/1/0429/7113/6154/files/davezerus.pdf
    • https://cdn.shopify.com/s/files/1/0430/8431/6823/files/what_is_a_discord_tag.pdf
    • https://cdn.shopify.com/s/files/1/0429/7788/6367/files/tojomakubelaref.pdf
    • https://cdn.shopify.com/s/files/1/0430/7366/7225/files/36458145714.pdf
    • https://cdn.shopify.com/s/files/1/0435/3749/8276/files/zezusegevagi.pdf
    • https://cdn.shopify.com/s/files/1/0435/6666/1800/files/71513567516.pdf
    • https://cdn.shopify.com/s/files/1/0432/2449/8333/files/xaruvuge.pdf
    • https://cdn.shopify.com/s/files/1/0436/9242/5384/files/bedezotujovuzivudovubupo.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/41697505155.pdf
    • https://cdn.shopify.com/s/files/1/0437/1444/5465/files/ccie_security_questions.pdf
    • https://cdn.shopify.com/s/files/1/0429/8362/0757/files/54437537772.pdf
    • https://cdn.shopify.com/s/files/1/0428/1679/8883/files/ccsk_exam_dumps.pdf
    • https://cdn.shopify.com/s/files/1/0438/1265/1170/files/sogoxaxovagunajuzisurar.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005173.bin
fbf06c9018a9c2bbfa175ef6148ddbe0379f26a022e40662db491bd87bbea99a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5173 5444 bytes
font_01_sfnt_off000063db.bin
c24427990e2d57ccf29bd63c16562090d5b889828ba5a595052d9756ff950c34		 pdf-font-stream PDF embedded font (sfnt) at offset 0x63DB 9392 bytes
font_02_sfnt_off0000840c.bin
7337fb98ea55020f3b3b58ad2f3067f17937eb2e86752b2d4ea00551cf3b57bf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x840C 18016 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.