Malicious PDF — malware analysis report

Static analysis result for SHA-256 333ad689b3a3dae5…

MALICIOUS

PDF

49.1 KB Created: 2020-09-13 15:38:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0225120ae6b4ac29de5d26ed7851d450 SHA-1: 2c54d949cbbb7ddd324220b381a6a4311f1da5d1 SHA-256: 333ad689b3a3dae500a7b4586f8e6926585dd4ef99f9505be562e890258abf6a
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a heuristic firing for PDF_MALICIOUS_REDIRECTOR_LINK, indicating it points to malicious infrastructure. Additionally, PDF_SEO_LINK_FARM suggests a large number of external links are embedded within the document, likely for SEO poisoning or to distribute malicious content. The primary malicious IOC is the redirector URL, which is likely used to funnel victims to further stages of an attack.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wb?keyword=el%20alquimista%20pdf%20google%20drive
    • https://cdn.shopify.com/s/files/1/0447/9247/9904/files/81576096169.pdf
    • https://cdn.shopify.com/s/files/1/0434/7405/9430/files/61670281294.pdf
    • https://cdn.shopify.com/s/files/1/0461/6444/3299/files/nekalanijar.pdf
    • https://cdn.shopify.com/s/files/1/0435/3107/5743/files/88460383196.pdf
    • https://static.usrfiles.com/ugd/b8c837_32307e46f22b4d13a12dade640d34f83.pdf
    • https://static.usrfiles.com/ugd/c57cae_a09a26ec252e410f8e4df7414724bf9d.pdf
    • https://static.usrfiles.com/ugd/90c678_ff5ddc5a2eed4388b7f590b41846e525.pdf
    • https://static.usrfiles.com/ugd/0c268c_fa011b4f70b84d199a9243f5bb5d81ee.pdf
    • https://static.usrfiles.com/ugd/b8c837_7ae49ca277b14659b5e708274f01ce8e.pdf
    • https://static.usrfiles.com/ugd/bc79a4_6bd644c4927e4883ab872ba370fd429a.pdf
    • https://static.usrfiles.com/ugd/ab63e3_2326f8f834264322bf04c50109c1fa08.pdf
    • https://static.usrfiles.com/ugd/12745a_44a6af7c029d4eecb783965f6423b19f.pdf
    • https://static.usrfiles.com/ugd/007d40_5dc4f82cde674df1b14940e7cab33f06.pdf
    • https://static.usrfiles.com/ugd/8ebb60_512375215e574fef8ddf417da6033056.pdf
    • https://static.usrfiles.com/ugd/1d5a3f_6968d8219cba4d7c89a93990e7e90148.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000058c7.bin
166d96cea65b4253bf24cfb2fb0855a4c0a3086d815300d6b1bd01de7176d036		 pdf-font-stream PDF embedded font (sfnt) at offset 0x58C7 5504 bytes
font_01_sfnt_off00006b6a.bin
08dd861a6b362565c202b4946999e3c2961b533ff9249211f474d2c102a05259		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6B6A 6456 bytes
font_02_sfnt_off00007d7a.bin
4da10c37386a00a6a6ca6bd1ab92d45da8c6bac9a2606d7d016b688d6524418b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7D7A 10096 bytes
font_03_sfnt_off0000a037.bin
4636c7523e8c0c4659ec89c752f488d70eb2ea504770eb3e0be851c502e4ce70		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA037 16488 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.