Malicious PDF — malware analysis report

Static analysis result for SHA-256 46060cfe8ba83b0f…

MALICIOUS

PDF

43.9 KB Created: 2020-08-28 12:08:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-26
MD5: e61087579d12733a47833989926f4b80 SHA-1: 848d0aed87fb5895470732162cd0dea487bb248a SHA-256: 46060cfe8ba83b0f62930847e7cc1937f501340c96260a6742bc920072455cfe
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous links, including one pointing to a known malicious redirector, suggesting a phishing or malware distribution attempt. The document body, though heavily obfuscated, contains text related to 'formula bookle' and a URL that aligns with the malicious redirector heuristic. The presence of multiple PDF links, many hosted on Shopify, indicates a link farm strategy to obscure the ultimate destination.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/pify?keyword=edexcel+further+maths+formula+bookle In PDF document text
    • http://files.cowlesmath.com/uploads/1/3/1/4/131455283/03b41002c98.pdfIn PDF document text
    • http://sijotexun.graceforthebroken.org/uploads/1/3/2/6/132695780/vexemawepogu.pdfIn PDF document text
    • http://files.brooksidechiropracticcare.com/uploads/1/3/0/8/130874134/jaxukumokatafanunogu.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://cdn.shopify.com/s/files/1/0439/1596/8667/files/pijasanufikobizekis.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0434/5525/0598/files/sands_of_the_coliseum_guide.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0430/1606/1091/files/gonajolabevetijolerug.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/xikidewutuxazumal.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0429/6271/4773/files/toxuzalogilunaxobixokago.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0432/3042/9346/files/wikipiru.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0437/7473/8586/files/verbs_and_adjectives_followed_by_prepositions.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0432/1758/4285/files/kolejozavikopabeguforik.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000040a6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x40A6 6452 bytes
SHA-256: 23e8cfde14408656995582c21943eeec0eccc9e5a2f65670b9631e3a4117aa8d
font_01_sfnt_off000050a8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x50A8 5492 bytes
SHA-256: 4037cd3d972fb818470958d9aff022d9272cc8b152139020050706aa3ff36376
font_02_sfnt_off00006322.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6322 1936 bytes
SHA-256: 246569b5fd7226bd0ebf3c016de7ba0bf82e996896d660a08030b2af0a08efd3
font_03_sfnt_off00006c62.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6C62 9356 bytes
SHA-256: b69d9867b6cc953f326671d94412af62bbe3f0e7a76daa9ae5bf8f891013e6a6
font_04_sfnt_off00008c21.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8C21 16336 bytes
SHA-256: b7ec44cfe2208ace95a2ce43e698390e22c67aa42018be4a86f0f90cbe714ace

Open this report in the interactive analyzer, or submit your own file for analysis.