Malicious PDF — malware analysis report

Static analysis result for SHA-256 3a90fda9f3daa73a…

MALICIOUS

PDF

49.0 KB Created: 2020-08-08 10:30:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d9eb1d0acf783cc778441bcdd11807f4 SHA-1: 90271ec892a4dd1790963c5b97d086f692c09f10 SHA-256: 3a90fda9f3daa73a9310c72a0f8cdb597519a2b240d8602bb01950793b19af31
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

This PDF contains a large number of embedded links, with one specifically pointing to a known malicious redirector. The heuristic firings indicate this is likely part of an SEO link farm or a redirection scheme to distribute malicious content. The ML classifier strongly supports the malicious nature of this document.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=spectrum+analyzer+theory+and+applications+pdf
    • http://files.storymakerlife.com/uploads/1/3/1/3/131383342/8315411.pdf
    • http://files.jennifersnowden.net/uploads/1/3/0/7/130739510/pevowigonujom-ziralokovag-xigumagi-popefux.pdf
    • http://files.insidersoman.com/uploads/1/3/1/3/131383333/sogutak_fudavi_juvipufujaj_bapun.pdf
    • http://wewuxetop.hope-medical.org/uploads/1/3/0/7/130776167/dasajeributew.pdf
    • http://files.bassassassin.com/uploads/1/3/1/4/131406592/a3827a35d1b23.pdf
    • https://cdn.shopify.com/s/files/1/0432/1512/6685/files/gawugobenubizonezexitof.pdf
    • https://cdn.shopify.com/s/files/1/0431/4424/9499/files/belelejufizutonowoxoj.pdf
    • https://cdn.shopify.com/s/files/1/0432/5317/0334/files/buvutibo.pdf
    • https://cdn.shopify.com/s/files/1/0437/4275/7029/files/41355448362.pdf
    • https://cdn.shopify.com/s/files/1/0431/0876/1764/files/convert_html_to_angular_7.pdf
    • https://cdn.shopify.com/s/files/1/0433/0435/3950/files/mujed.pdf
    • https://cdn.shopify.com/s/files/1/0436/7230/5817/files/zupamebilovifoferep.pdf
    • https://cdn.shopify.com/s/files/1/0432/0880/2468/files/tebizubovijuboda.pdf
    • https://cdn.shopify.com/s/files/1/0435/7790/1219/files/zifivamarutosewixijin.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/55628578329.pdf
    • https://cdn.shopify.com/s/files/1/0427/4061/3286/files/wikutidegulosedur.pdf
    • https://cdn.shopify.com/s/files/1/0429/1608/5923/files/kinukemimivikoroni.pdf
    • https://cdn.shopify.com/s/files/1/0432/2410/5124/files/90048655364.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://cdn.shopify.com/s/files/1/0432/2410/5124/files/90048655

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006d8b.bin
f6bf3182ab6f0ab9aeafe0a16a24254ea3f1ae342748b497a7163c967527124d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6D8B 5652 bytes
font_01_sfnt_off000080a0.bin
d6d719241f2e8f7be7b3a1c0d2259fbfc5c12a8d6024af5d2f2b44c281c85b90		 pdf-font-stream PDF embedded font (sfnt) at offset 0x80A0 1952 bytes
font_02_sfnt_off000089e9.bin
3473a025403f0d5d0a597605971124c9d48afa831d02ffdd4ec5c41308df667d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x89E9 14160 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.