Malicious PDF — malware analysis report

Static analysis result for SHA-256 54f9d040baf2fe4a…

MALICIOUS

PDF

47.3 KB Created: 2020-07-17 14:50:24 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d6ab78c09466bc18d6a80bb4614a59b8 SHA-1: 092fb6543c4731411c3aa289d27252556015f39d SHA-256: 54f9d040baf2fe4a1fec9cecd345e5fb393514025cb5c0a74301bdb89c54d3a8
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a mass external link farm, with the primary link redirecting to known malicious infrastructure. The document body, though heavily obfuscated, appears to be a lure related to a book title, likely intended to trick users into clicking the malicious link. The ML classifier strongly supports the malicious verdict.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wb?keyword=frog%20and%20toad%20are%20friends%20by%20arnold%20lobel%20pdf
    • http://files.emittherapeutics.com/uploads/1/3/0/7/130776769/9741550.pdf
    • http://files.lrshows.com/uploads/1/3/1/4/131406544/fivuzejotuzibowejale.pdf
    • http://files.muthacluckaz.com/uploads/1/3/0/9/130969002/nojonobi_lefafagev_kugibusavif_sevafoxedatewe.pdf
    • http://files.girlytingz2.com/uploads/1/3/1/4/131437538/bidomosarodan_pivojom_vesekerixiwilo_bakek.pdf
    • http://files.okstructures.com/uploads/1/3/1/0/131070762/wiledekubojuruz_zeripas.pdf
    • http://files.trinitydentalcentre.ca/uploads/1/3/0/9/130969522/7044359.pdf
    • http://files.pacehighchoir.com/uploads/1/3/1/8/131871891/2056809.pdf
    • http://files.emgotv360history.online/uploads/1/3/1/4/131411411/zutawazudolopabuku.pdf
    • http://files.madelinereidphotography.com/uploads/1/3/1/3/131383613/tibuxevupe.pdf
    • http://files.pacehighchoir.com/upload
    • https://kovawax.files.wordpress.com/2020/07/nojibumaked.pdf
    • https://nidebobuloj.files.wordpress.com/2020/07/68757900348.pdf
    • https://remopar.files.wordpress.com/2020/06/xegixuvamipasapixavin.pdf
    • https://pokivuwewej.files.wordpress.com/2020/07/tekepapijef.pdf
    • https://cdn.shopify.com/s/files/1/0435/1338/1028/files/nifokepopagosugede.pdf
    • https://cdn.shopify.com/s/files/1/0431/3550/0439/files/xikeligunoweluperofiv.pdf
    • https://cdn.shopify.com/s/files/1/0431/7144/6939/files/82647165519.pdf
    • https://cdn.shopify.com/s/files/1/0433/3250/1656/files/xuzurupepe.pdf
    • https://cdn.shopify.com/s/files/1/0428/1411/1903/files/kaguz.pdf
    • https://cdn.shopify.com/s/files/1/0428/2528/5798/files/93845076529.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/mojarugalemidim.pdf
    • https://cdn.shopify.com/s/files/1/0427/9926/8003/files/63967661616.pdf
    • https://cdn.shopify.com/s/files/1/0433/8037/5704/files/97831536572.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/duliwoledemovaj.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007bfb.bin
5cd1c1fbbf8aebcab9c9bb5d8d1d91c15fef5e59fc951781039f2dfc08d9372d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7BFB 5196 bytes
font_01_sfnt_off00008db6.bin
de68b0a403c34503a889511d58d8109d13421a12566a783e3210e20d6ed540eb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8DB6 9760 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.