Malicious PDF — malware analysis report

Static analysis result for SHA-256 4a6abf1d33457b22…

MALICIOUS

PDF

48.2 KB Created: 2020-10-20 22:43:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d40502c4c98b0fb4bf070410583bbc8f SHA-1: 1912cdcaf657dabf3e5f52289fdbf80ff9b9b8f4 SHA-256: 4a6abf1d33457b22fe19c02db6a1c044392064e6fc392b5d27e55f66b7545e91
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains embedded links, with one prominently pointing to a malicious redirector. The document body, though heavily obfuscated, includes text related to 'bigo live old apk download' and the malicious URL, suggesting a lure for users seeking this content. The ML classifier strongly indicated maliciousness, and the PDF structure itself is flagged for containing a link farm.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/123?keyword=bigo+live+old+apk+download
    • https://cdn-cms.f-static.net/uploads/4368996/normal_5f8b1161559a3.pdf
    • https://cdn-cms.f-static.net/uploads/4383475/normal_5f8ce4eebd8bb.pdf
    • https://cdn-cms.f-static.net/uploads/4369654/normal_5f8d198fea21d.pdf
    • https://cdn-cms.f-static.net/uploads/4371261/normal_5f89b7ed47823.pdf
    • https://cdn-cms.f-static.net/uploads/4369900/normal_5f8a968a42613.pdf
    • https://cdn-cms.f-static.net/uploads/4393208/normal_5f8f061eec444.pdf
    • https://cdn-cms.f-static.net/uploads/4375076/normal_5f8a28d829dca.pdf
    • https://cdn-cms.f-static.net/uploads/4382643/normal_5f8df3717c8c3.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0439/2094/9403/files/92196996925.pdf
    • https://cdn.shopify.com/s/files/1/0484/0125/2510/files/doxanipe.pdf
    • https://cdn.shopify.com/s/files/1/0435/5417/7185/files/bolowixijerope.pdf
    • https://cdn.shopify.com/s/files/1/0503/4967/0560/files/17212879689.pdf
    • https://cdn.shopify.com/s/files/1/0434/1825/5516/files/overlays_pro_apk_terbaru.pdf
    • https://s3.amazonaws.com/memul/17189477737.pdf
    • https://s3.amazonaws.com/zirojopemup/87709079591.pdf
    • https://cdn.shopify.com/s/files/1/0439/1731/2152/files/juego_vestir_a_bulma_apk.pdf
    • https://cdn.shopify.com/s/files/1/0499/9407/2214/files/router_letter_templates_menards.pdf
    • https://cdn.shopify.com/s/files/1/0504/2585/6198/files/gabegejativo.pdf
    • https://uploads.strikinglycdn.com/files/1693f20e-1c70-43cf-ae1f-9e28cf9e36f7/97932886663.pdf
    • https://uploads.strikinglycdn.com/files/9354609f-47fa-4bf9-b6bf-db1a1eb143f3/39187232587.pdf
    • https://uploads.strikinglycdn.com/files/385d1a90-de37-4864-8bc3-b98ce19cb29d/94017692788.pdf
    • https://uploads.strikinglycdn.com/files/1854424c-678b-4494-8b27-b1613ccae192/25684598981.pdf
    • https://uploads.strikinglycdn.com/files/982cfd16-110c-42ce-be1d-993d00d6a0d4/23650704675.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007447.bin
50a09ab9d49ac72813ed5b31bddaeb1f9da3ea2d5167be0aa87f4d4bbb051f28		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7447 5120 bytes
font_01_sfnt_off000085db.bin
83f4865405a355fd300852ffb8d134d8da8aa36cb31af9bbe9306fbf9ab5bc67		 pdf-font-stream PDF embedded font (sfnt) at offset 0x85DB 14256 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.