Malicious PDF — malware analysis report

Static analysis result for SHA-256 458cb904d14d0741…

MALICIOUS

PDF

37.2 KB Created: 2020-09-17 03:23:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c3d2a31973434ef95fa6deecd6f1ad08 SHA-1: 71e14d05b61037d38d3d3b3429178fd648adfa96 SHA-256: 458cb904d14d0741d70a8a37c539d13d22af3281da4bafdbcfa299cef2c4e19e
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file exhibits characteristics of a malicious redirector and SEO link farm, as indicated by multiple critical heuristic firings. It contains numerous embedded URLs, with at least one pointing to a known malicious redirector infrastructure. The document body, though heavily obfuscated, contains a URL that matches the malicious redirector. The primary attack pattern involves luring users to click on these links, which likely leads to further malicious content or exploits.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/wix?keyword=coarsely+comic+crossword+clue
    • http://besizobaf.sciencedee.com/uploads/1/3/1/4/131438641/f32df46cfb3add.pdf
    • http://gebigojap.annapike.co.uk/uploads/1/3/0/8/130874482/7d43792934f7.pdf
    • http://files.ballstatepsychsciencema.us/uploads/1/3/2/3/132303320/zufored-lovewuk-pumoti-zexibivibodil.pdf
    • http://kozewazer.ice-fyre.ca/uploads/1/3/2/8/132814930/5978905.pdf
    • https://cdn.shopify.com/s/files/1/0446/8791/7209/files/accounts_payable_interview_questions_and_answers_download.pdf
    • https://cdn.shopify.com/s/files/1/0437/6985/6158/files/bike_crash_meme_template.pdf
    • https://cdn.shopify.com/s/files/1/0458/5953/7049/files/bundle_size_android.pdf
    • https://cdn.shopify.com/s/files/1/0459/9844/0605/files/64677205879.pdf
    • https://cdn.shopify.com/s/files/1/0446/1314/0643/files/vibrations_and_waves_george_c_king.pdf
    • https://2ef7debd-ffb8-442a-849d-5e3471a8fcb9.filesusr.com/ugd/3aca14_c38bff062f484e7b8ed804bd777b903b.pdf?index=true
    • https://628b4481-851f-4f4b-a475-94c9020fd17e.filesusr.com/ugd/dad90e_eb42bd8c71b84384b8a61e0574a6d176.pdf?index=true
    • https://920fd11a-8485-49e0-9c4d-22bd42718aba.filesusr.com/ugd/1a1092_07b244593bf54d259e6374081eee34cd.pdf?index=true
    • https://4326930e-022b-468b-b137-983f9499a56b.filesusr.com/ugd/33ab24_46db40b81b0e426690cae40ecd3c3878.pdf?index=true
    • https://cdn.shopify.com/s/files/1/0435/8848/5288/files/51932740765.pdf
    • https://cdn.shopify.com/s/files/1/0434/0255/9655/files/d_d_5e_tomb_of_annihilation_free_download.pdf
    • https://cdn.shopify.com/s/files/1/0427/9926/8003/files/68737267061.pdf
    • https://cdn.shopify.com/s/files/1/0445/3564/4319/files/bobina_de_tesla_principios_fisicos.pdf
    • https://cdn.shopify.com/s/files/1/0437/5497/9477/files/kukorin.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000053e2.bin
b689a214af561141e6053d4264ead9d5b7031eb0c73a9b34925b8887495cd4b7
pdf-font-stream PDF embedded font (sfnt) at offset 0x53E2 5184 bytes
font_01_sfnt_off00006583.bin
e965f93b1eca0ef934168df25505bea515e23c9a1faef22d379dfcd47320fff6
pdf-font-stream PDF embedded font (sfnt) at offset 0x6583 10088 bytes