Malicious PDF — malware analysis report

Static analysis result for SHA-256 3baedbc4815429e6…

MALICIOUS

PDF

35.3 KB Created: 2020-09-12 11:52:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c3dab4453b2eb476dcbb7123cd0a8575 SHA-1: 63204ad8f5fa3bb9628074e08155f61a8684f544 SHA-256: 3baedbc4815429e6938e523528b76bff5b20e0d08c48a2919c8e24848976ef17
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a link to a redirector, which is a common tactic for delivering malicious payloads or phishing pages. The document body, though heavily obfuscated, contains text related to 'audio editor apk for windows' and the malicious URL, suggesting a lure to download potentially unwanted software or access a phishing site. The PDF also contains a large number of links to other PDFs, indicating a link farm used for SEO poisoning or to distribute further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=audio+editor+apk+for+windows
    • https://static.usrfiles.com/ugd/b48b60_e6d85706d9a14ab9a9747ae4a101cccd.pdf
    • https://static.usrfiles.com/ugd/0c41e7_5f84018b55544758beddef3774ee1e5f.pdf
    • https://static.usrfiles.com/ugd/2c7c49_e2ba8a43f6f44b078711c24efdff8961.pdf
    • https://static.usrfiles.com/ugd/f99735_dae306b0476f4be5a8e01b84e2e151cc.pdf
    • https://static.usrfiles.com/ugd/70c1f8_69a74a921da9467db0acb5df505f273d.pdf
    • https://static.usrfiles.com/ugd/f459ea_0b04f367893a4a87900b9196433b7996.pdf
    • https://static.usrfiles.com/ugd/f34823_e953c65b0ebf4cc785445fe7c874e179.pdf
    • https://static.usrfiles.com/ugd/81d6a4_0ee924e086594c0db9ca6029d163d62c.pdf
    • https://cdn.shopify.com/s/files/1/0435/0056/8736/files/99878720438.pdf
    • https://cdn.shopify.com/s/files/1/0430/0115/1651/files/dikolikenizavon.pdf
    • https://cdn.shopify.com/s/files/1/0433/5822/4549/files/mijewu.pdf
    • https://cdn.shopify.com/s/files/1/0433/7238/0318/files/220_bus_timetable_carrigaline.pdf
    • https://cdn.shopify.com/s/files/1/0436/6788/2134/files/merriam_webster_geographical_dictionary.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004d26.bin
f219103db6bbbdc561a16bb3b6847ea35648f6b4a5b1076e7cc0570a4e72fd54		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4D26 5148 bytes
font_01_sfnt_off00005ed3.bin
2d898887406ddcb4f08c10eb0939302aa425cdded28b832c24ab889fc552a25a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5ED3 9968 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.