Malicious PDF — malware analysis report

Static analysis result for SHA-256 555856ec37597335…

MALICIOUS

PDF

37.3 KB Created: 2020-09-17 09:39:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 31da48540505b8b0e321b1ac5a03bb89 SHA-1: de4248654f7f6d7b1b974da9fa59ee6d13c28753 SHA-256: 555856ec37597335b74033a0cacae97e0c9d4947723024ca657000f926c73f32
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF was flagged as malicious due to a large number of embedded links, many of which point to redirector infrastructure. The document body contains a URL that leads to a known malicious redirector. The presence of numerous links suggests an attempt to distribute malicious content or conduct phishing attacks.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=governor+wentworth+reg+school+district
    • http://nobopoj.excelfitnesscenter.net/uploads/1/3/2/6/132680874/zazipatexefanogupaka.pdf
    • http://files.rachelsawyer.co.uk/uploads/1/3/1/6/131636745/4651e8eadc5d5.pdf
    • http://files.letschoosejoy.com/uploads/1/3/0/7/130775934/gerorepeputibuj.pdf
    • http://kawuvo.rambosiu.com/uploads/1/3/1/3/131398222/a7a2e0875e11862.pdf
    • http://files.treecave.com/uploads/1/3/1/3/131379844/norakog-wuzilodejivorim.pdf
    • https://c233eeae-9641-421f-b3c6-81b6a12a5fef.filesu
    • https://5eeebd55-f4f9-4a96-b93e-6b5ea1e5827f.filesusr.com/ugd/b148e5_2eeac1333d9c4eb3b2ddac8d3cc20d49.pdf?index=true
    • https://d6f84261-6ab4-458c-9cee-5d342baf1095.filesusr.com/ugd/95ea6b_b61a688959ab49c8b42c295d9d5b5878.pdf?index=true
    • https://df57ec9e-db5b-4e2c-896e-23420c37a5f0.filesusr.com/ugd/405339_0e825ff8185543ffbf18c15713c884eb.pdf?index=true
    • https://dd341ee0-2f11-463d-b5aa-2ca22e1530b1.filesusr.com/ugd/784815_1dadce8875914680ba09c82e7c09ffb4.pdf?index=true
    • https://1ee8bc26-f912-45a4-985a-49a665fc641f.filesusr.com/ugd/912de2_779e593a4e5c4e0b9e3adfbb26fa0e45.pdf?index=true
    • https://423742ef-cf3f-4ad2-aa7e-a25734eaf4c8.filesusr.com/ugd/3dd68e_7dac2cc645c74e6fa73306529ba500ab.pdf?index=true
    • https://74d637ab-7b16-4373-a039-9485b867238e.filesusr.com/ugd/227d0f_811ba88173b242c29764f71e161be61b.pdf?index=true
    • https://5c9f1b38-c9cd-462b-9e4b-3a12fabb9552.filesusr.com/ugd/9b7d8a_ecf83e4df20f41d0ac36bfe29fff5c67.pdf?index=true
    • https://e3444c42-450d-42f7-ad98-1323ac03f1e0.filesusr.com/ugd/bd5c68_90c63853a1be42ee84ef4924d950fb60.pdf?index=true
    • https://c233eeae-9641-421f-b3c6-81b6a12a5fef.filesusr.com/ugd/314c35_63106e2c52884378b684c8f60d5cbdbc.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005258.bin
9a4b7f7da310feba489e8abd45d677594e736241891b5f56c8f496080952c22d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5258 5172 bytes
font_01_sfnt_off0000640b.bin
873f98fcd9002ee4754ca139614fde43f71108bd8ee2848e230c83498d6580b3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x640B 10548 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.