Malicious PDF — malware analysis report

Static analysis result for SHA-256 5b1f5a8233d209e7…

MALICIOUS

PDF

57.2 KB Created: 2020-08-12 17:14:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e5e8c32791ef93c1f1c59083c91b58e2 SHA-1: fcafa11e8c873c35a9565361de6c897243de78be SHA-256: 5b1f5a8233d209e7e6f0cf601e87b150b1cca9946f7dc3ac9521c6d0177b9e0d
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links, many of which point to external PDF files, suggesting a link farm for SEO manipulation. One prominent link, 'https://ttraff.com/pify?keyword=download+essential+hematology+6th+edition+pdf', is identified as a malicious redirector. This indicates the document is likely part of a campaign to drive traffic to malicious infrastructure, possibly for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=download+essential+hematology+6th+edition+pdf
    • http://files.southshoredeckbuilders.com/uploads/1/3/2/3/132303035/bopawof-rodapiwaluv-nukanavawoxun.pdf
    • http://files.alfredofatale.com/uploads/1/3/2/3/132302993/1286888.pdf
    • http://mupetu.fromhooftoheart.com/uploads/1/3/1/6/131606349/tiwekeroguj.pdf
    • http://files.pressnellcreative.com/uploads/1/3/2/6/132683168/kumosejaduve.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://cdn.shopify.com/s/files/1/0431/7030/0061/files/nebuxebeluwekelusafifi.pdf
    • https://cdn.shopify.com/s/files/1/0433/9892/2392/files/85673726539.pdf
    • https://cdn.shopify.com/s/files/1/0447/8458/2813/files/cambridge_english_empower_upper_intermediate_workbook.pdf
    • https://cdn.shopify.com/s/files/1/0437/1932/7896/files/zugaronow.pdf
    • https://cdn.shopify.com/s/files/1/0434/7835/2034/files/news_report_sample.pdf
    • https://cdn.shopify.com/s/files/1/0432/5595/5619/files/74178167427.pdf
    • https://cdn.shopify.com/s/files/1/0433/8070/3399/files/nopemebagaxifonagix.pdf
    • https://cdn.shopify.com/s/files/1/0433/7673/8462/files/komigibipeter.pdf
    • https://cdn.shopify.com/s/files/1/0429/5717/6986/files/rubikenejemijugulijelun.pdf
    • https://cdn.shopify.com/s/files/1/0434/4817/2710/files/peak_roland_smith.pdf
    • https://cdn.shopify.com/s/files/1/0431/8350/5570/files/97577545104.pdf
    • https://cdn.shopify.com/s/files/1/0431/5093/4173/files/7594572797.pdf
    • https://cdn.shopify.com/s/files/1/0431/4529/8074/files/digajevefilomove.pdf
    • https://cdn.shopify.com/s/files/1/0437/3600/6817/files/tifimosajixogepa.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006edf.bin
5bf6ad5af7b9065df76890b568ef97c33bced068fae3b5c27b47daaa9d369f0f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6EDF 5496 bytes
font_01_sfnt_off00008187.bin
45c0122f5ff72d3bac36aa0852f8de0558c0a0c977083c4162fff74412a02704		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8187 14660 bytes
font_02_sfnt_off0000af6f.bin
a2ae039c210aec497981687fc4e9b5f36e72a8eba08f71482a1ba1745398ecc3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAF6F 17368 bytes
font_03_sfnt_off0000c8f2.bin
1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC8F2 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.