Malicious PDF — malware analysis report

Static analysis result for SHA-256 551a1485ee913446…

MALICIOUS

PDF

42.9 KB Created: 2020-09-17 11:14:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f10b7feccef5d9a6474e448d878d9288 SHA-1: 9c3ea87bba72389c59fa199e680be51521c7a52c SHA-256: 551a1485ee9134467c6010b2c52615c63157c3e11d47bfc730bf7c94e28c3a48
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a mass external link farm, with one URL pointing to a known malicious redirector. The document body, though heavily obfuscated, contains text that appears to be a lure for 'Eve online skill guide'. The ML classifier strongly flagged this PDF as malicious. The primary attack vector is likely a phishing lure delivered via a malicious PDF, redirecting the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/wix?keyword=eve+online+skill+guide
    • http://files.drkaylee.us/uploads/1/3/1/8/131871648/5238261.pdf
    • http://files.fredrikpihl.com/uploads/1/3/0/7/130776073/rexitabadug_seniwululemamew_bawemida.pdf
    • http://kesulaw.daragildner.com/uploads/1/3/1/4/131454215/1326a6a18905f53.pdf
    • http://files.petiakostadinova.net/uploads/1/3/1/6/131606407/fokazadugot_bupowogetum_givules_toxelebafatiju.pdf
    • https://42823376-1610-44c0-985a-23ee0f932319.filesusr.com/ugd/1e533a_22b5f06464ae473aaddc725c5fb98210.pdf?index=true
    • https://898954ea-170b-4e64-b461-ffd4d1a89c64.filesusr.com/ugd/d902bb_5628a0e3a062445a9a009d94b394720b.pdf?index=true
    • https://c3494bf5-3674-4705-bb62-0cc096efb769.filesusr.com/ugd/1cc777_c0a505ca6c72468cbdeb01743b34dcfa.pdf?index=true
    • https://c2c8b059-47b4-4e3c-8a9f-9cebc80b2945.filesusr.com/ugd/8acad3_3a972172aff043d5aeaf7a612b21b6ff.pdf?index=true
    • https://b040bd3a-a885-4864-964b-27e0eca6bd66.filesusr.com/ugd/c33f71_9f68edf57a6d4bccb3e4f8bcf5d8e81c.pdf?index=true
    • https://cdn.shopify.com/s/files/1/0439/3864/4123/files/god_of_war_iii_remastered_trophy_guide.pdf
    • https://cdn.shopify.com/s/files/1/0432/4196/3683/files/muguximepo.pdf
    • https://cdn.shopify.com/s/files/1/0434/0062/6325/files/14827652311.pdf
    • https://cdn.shopify.com/s/files/1/0437/8679/7213/files/pigidigibojapamajuseko.pdf
    • https://cdn.shopify.com/s/files/1/0462/3902/3253/files/85024633432.pdf
    • https://cdn.shopify.com/s/files/1/0431/4575/6821/files/bpcl_vts_app.pdf
    • https://cdn.shopify.com/s/files/1/0433/0664/7717/files/kebemulapunefe.pdf
    • https://cdn.shopify.com/s/files/1/0431/7492/0347/files/worewogisubi.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006aae.bin
80f5712d968a308da6ff2500a5fe9e09c0275fdcb61603ef8e52b250b090606d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6AAE 4768 bytes
font_01_sfnt_off00007b08.bin
0f7d9311783bb391f55851a9a9023d92e0288cfd8dcf8f27e1f9319ac16d95e5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7B08 10352 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.