Malicious PDF — malware analysis report

Static analysis result for SHA-256 3c9f02b71c3025cb…

MALICIOUS

PDF

40.2 KB Created: 2020-08-17 02:02:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b8668640db642c1c6b2df5f3b0db834f SHA-1: 521e521aad4f39babfbeb559ebf97efa99153185 SHA-256: 3c9f02b71c3025cbc7577163f22f97dff18d733287736f701df22e82ec070cae
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was identified as malicious due to a high number of embedded links, many of which point to known malicious redirectors. The document body, though heavily obfuscated, contains text related to 'common business english phrases pdf' and the wkhtmltopdf tool, suggesting a lure to disguise the malicious intent. The primary malicious IOC is the redirector URL, which likely leads to further stages of the attack.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=common+business+english+phrases+pdf
    • http://files.azra-india.com/uploads/1/3/1/4/131437064/9056093.pdf
    • http://visile.kgreigcpa.com/uploads/1/3/1/4/131438216/5924633.pdf
    • http://zepoxepob.anastasiabickel.com/uploads/1/3/0/9/130968996/lirokeje_nefubejiwigivuf_wuduzulufat_newotozokufunek.pdf
    • https://cdn.shopify.com/s/files/1/0429/7441/2949/files/sugaxomifutubaributevusev.pdf
    • https://cdn.shopify.com/s/files/1/0436/9154/0634/files/73453468752.pdf
    • https://cdn.shopify.com/s/files/1/0429/5573/5193/files/bupijifako.pdf
    • https://cdn.shopify.com/s/files/1/0431/0673/0144/files/92856656055.pdf
    • https://cdn.shopify.com/s/files/1/0435/5581/5583/files/suputelow.pdf
    • https://cdn.shopify.com/s/files/1/0432/4202/9215/files/aranyak_story.pdf
    • https://cdn.shopify.com/s/files/1/0429/7926/2623/files/99422217727.pdf
    • https://cdn.shopify.com/s/files/1/0438/2857/6416/files/susaxa.pdf
    • https://cdn.shopify.com/s/files/1/0435/6335/2227/files/political_map_of_south_africa.pdf
    • https://cdn.shopify.com/s/files/1/0428/3754/1031/files/charades_movies.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005fb2.bin
8f578d3c952eefe66ef245d363aa2556b1ea882a5e41cf1c8d8e4e17ad7d603f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5FB2 5500 bytes
font_01_sfnt_off0000722e.bin
b47b9af6e8dce24603181e56fa78d78718ddb76e601c48a92e83b4050f203724		 pdf-font-stream PDF embedded font (sfnt) at offset 0x722E 9908 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.