Malicious PDF — malware analysis report

Static analysis result for SHA-256 581c2ec977d0d241…

MALICIOUS

PDF

50.2 KB Created: 2020-08-12 00:26:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a820b8877004a6a49506a0d3bd5e5829 SHA-1: 74b31c29cb9cd041c48e18bfe3e7b936ebbaf78d SHA-256: 581c2ec977d0d241dbc31c7ecd27646fe912308fef3e821b3d6d613b67ae5f03
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF was flagged by multiple critical heuristics for containing a malicious redirector link and a link farm. The ML classifier also strongly indicated maliciousness. The embedded URL points to a redirector service, likely intended to obscure the final destination and potentially deliver a malicious payload or phish for credentials. The document body contains garbled text but includes the suspicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=salsa+bechamel+historia+pdf
    • http://files.austintricyclist.com/uploads/1/3/0/8/130874009/6435697.pdf
    • http://files.sandystories.org/uploads/1/3/2/8/132816195/c3c9919ae425.pdf
    • http://files.stoneharborpawprints.com/uploads/1/3/0/8/130873918/41fe9a1e89b5.pdf
    • http://sipepad.embracemyanmar.com/uploads/1/3/0/8/130874493/145ce535c236d0.pdf
    • https://cdn.shopify.com/s/files/1/0435/5099/8679/files/partitura_de_hey_jude.pdf
    • https://cdn.shopify.com/s/files/1/0433/9079/5934/files/wikodawig.pdf
    • https://cdn.shopify.com/s/files/1/0427/7813/2636/files/6719329708.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/98629167596.pdf
    • https://cdn.shopify.com/s/files/1/0434/3165/7638/files/binanoritulike.pdf
    • https://cdn.shopify.com/s/files/1/0435/0096/1947/files/dobevuzuzusebilasaja.pdf
    • https://cdn.shopify.com/s/files/1/0433/4954/1013/files/tiwasegidajirarufukop.pdf
    • https://cdn.shopify.com/s/files/1/0434/8713/3860/files/estenosis_bilateral_de_la_arteria_renal.pdf
    • https://cdn.shopify.com/s/files/1/0434/1848/4888/files/classifying_real_numbers_mystery_pattern_answer_key.pdf
    • https://cdn.shopify.com/s/files/1/0450/7284/2915/files/94849864642.pdf
    • https://cdn.shopify.com/s/files/1/0431/4093/9933/files/40948763291.pdf
    • https://cdn.shopify.com/s/files/1/0438/2952/6688/files/lenelapogezivij.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006085.bin
4fba18d06a786e55b894435998c4ea958c98d549ef6c2f2f6603a2b9ee6f3bfb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6085 5636 bytes
font_01_sfnt_off00007338.bin
fba9f6d5d467b7d6bbccdc8ac95b73ea8a6825a62cfb156e50cd914bb525142d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7338 6300 bytes
font_02_sfnt_off00008291.bin
aa05dee68a0ddaa7c0329c72a1718d34397d630e90b6c30b81df4de5924513ce		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8291 10372 bytes
font_03_sfnt_off0000a651.bin
7ebbc2ca5111f8929629b5f13ee6925e48c04e0bbd4f00b7f694cf833f27cb56		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA651 16096 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.