Malicious PDF — malware analysis report

Static analysis result for SHA-256 4870f06719cbfc0a…

MALICIOUS

PDF

43.7 KB Created: 2020-09-18 22:02:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 006c744321024a57d5ca1a10c0ad765b SHA-1: 2d910e1e83f60bd35c58b840d99db1f1655027fd SHA-256: 4870f06719cbfc0ab0ecf6623ee88c411ca7e3d1a10fbdb05119164b27ddbb9a
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains numerous embedded links, with one specifically identified as a malicious redirector. The document body, though heavily obfuscated, contains text related to automotive parts and URLs that appear to be part of a link farm designed for SEO manipulation. This suggests the document's primary purpose is to drive traffic to malicious or spam-related websites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=2001+ford+f150+4.6+transmission+fluid+type
    • http://files.emeraldcentre.org/uploads/1/3/1/1/131163540/rezaba.pdf
    • http://files.drtangiethesexdoctor.com/uploads/1/3/1/4/131452904/xozesakofuza-rilinasirog-durinide.pdf
    • http://kobon.celesteschexnaydre.com/uploads/1/3/0/9/130969895/a7e5a1.pdf
    • https://ca2fdbb8-7063-401d-94b9-eac1811bdd4c.filesusr.com/ugd/f6336d_dcb1a462c2da40a48bbc28fa7e63aab2.pdf?index=true
    • https://6973965c-8bcc-45a7-aa03-73a88c505de7.filesusr.com/ugd/c4f63d_5d43fa07dba34db8993928b9c368ac46.pdf?index=true
    • https://cf25e517-e503-4afb-844f-077c2ec1213d.filesusr.com/ugd/b361c6_2da6effaf3564313aaa47f725c05d335.pdf?index=true
    • https://d548a872-fb9f-4c6a-a4dc-f09cceebaf2b.filesusr.com/ugd/d13e1f_c1ff968ee526451fa51110594d52cd7c.pdf?index=true
    • https://1f619619-e4ea-42fc-8bfa-2e967010b269.filesusr.com/ugd/44b221_5f4cff9eac684629bd9f18db454923e1.pdf?index=true
    • https://995d1a4b-d105-4981-86e9-645805b44f23.filesusr.com/ugd/e32576_b9d93fc02fa8459eb9e1ebbbcb9aec55.pdf?index=true
    • https://f28128a7-6976-4a70-980b-b4ab09b12de7.filesusr.com/ugd/1b9faa_96776d11cb724741a602ad57022ece47.pdf?index=true
    • https://31054477-8004-4820-a32d-5245707c1c0c.filesusr.com/ugd/7d1dc9_d40188a533aa463790223e48394e3249.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000610c.bin
aacb132228a599c3ced06495c2ae2f0ed8cf30185ecc0cff98ccc2c7f234e4f1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x610C 5916 bytes
font_01_sfnt_off00007538.bin
c9f0a7e50d0740733b055e8e4b6fe94947141ad16f563b43b1efd252e42541fc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7538 14648 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.