Malicious PDF — malware analysis report

Static analysis result for SHA-256 31514ae738a6ad45…

MALICIOUS

PDF

46.1 KB Created: 2020-07-28 01:44:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a52c73a8d259b1838e6e3896e7bb94a8 SHA-1: c40755eb489afd2b50f2165deaa9d7de36b7836a SHA-256: 31514ae738a6ad45eb7d4c0dc9a8c3b265600a8c236c61ea4a2bfa03b681f9ec
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains multiple embedded links, with one identified as a malicious redirector and another pointing to a link farm of 13 PDFs. The ML classifier also flagged this PDF with high confidence. The document body is heavily obfuscated and appears to contain metadata rather than user-facing content, suggesting the primary purpose is malicious redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=sacral+dimple+ultrasound+guidelines
    • http://files.myresumebuilder123.com/uploads/1/3/0/8/130874490/mijimajaw_nupaxijodadol_tamewaka.pdf
    • http://files.newlifevb.net/uploads/1/3/1/8/131871644/a47f39715d515.pdf
    • http://files.acsextracurriculars.com/uploads/1/3/2/6/132683188/89e92b.pdf
    • https://cdn.shopify.com/s/files/1/0431/9395/8560/files/78379850403.pdf
    • https://cdn.shopify.com/s/files/1/0430/7763/2154/files/26901684036.pdf
    • https://cdn.shopify.com/s/files/1/0434/7379/7285/files/64396216569.pdf
    • https://cdn.shopify.com/s/files/1/0430/0183/9769/files/mabab.pdf
    • https://cdn.shopify.com/s/files/1/0428/7689/5398/files/bekumunedeje.pdf
    • https://cdn.shopify.com/s/files/1/0430/6301/7629/files/fafetagoz.pdf
    • https://cdn.shopify.com/s/files/1/0431/7233/1675/files/25804473710.pdf
    • https://cdn.shopify.com/s/files/1/0431/8560/2721/files/bekuxekagasogimafadur.pdf
    • https://cdn.shopify.com/s/files/1/0430/6350/9141/files/tedefujolabamat.pdf
    • https://cdn.shopify.com/s/files/1/0429/7873/8335/files/gagizuluvizidomejodup.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://cdn.shopify.com/s/fi

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000075b5.bin
4db1135e04525c5bfdf55bff444fe284c1367e0a1cb65381b5754a097f9325d1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x75B5 5380 bytes
font_01_sfnt_off000087d7.bin
dc6dff959d8a72e819d35100ce850538fb3af8172d7a1c916d11126a0e4267d3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x87D7 10372 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.