Malicious PDF — malware analysis report

Static analysis result for SHA-256 5d673aa74a2f3e6d…

MALICIOUS

PDF

43.5 KB Created: 2020-08-03 16:49:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7cc71310d844c61de9d0946ee85ec01f SHA-1: 32fd96a4abdcadd830f127910ccd76d650725098 SHA-256: 5d673aa74a2f3e6d81c2840cf41cda2e6c0105bca9086b8aba840b1b672c4a91
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a link farm and a malicious redirector URL, indicating an attempt to lead users to harmful content. The embedded URL and the ML classifier strongly suggest malicious intent. The document body, while obfuscated, contains the malicious URL, reinforcing the attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=change+adjectives+into+adverbs+exercises+pdf
    • http://files.packerpottery.com/uploads/1/3/1/4/131437418/pukewazagizidik-magavasisora-zumitofasa-pural.pdf
    • http://files.summerraechase.com/uploads/1/3/0/8/130813855/af63dc7714aa.pdf
    • http://files.houndshangout.ca/uploads/1/3/1/4/131407761/2803822.pdf
    • http://files.dannythecoach.com/uploads/1/3/2/3/132303264/jabimorif_mowotaful_pasamalipavizux.pdf
    • http://files.fotofringelondon.com/uploads/1/3/1/4/131438509/5e3153f0.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/33435760041.pdf
    • https://cdn.shopify.com/s/files/1/0432/6237/8152/files/40688422101.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/bokowolexom.pdf
    • https://cdn.shopify.com/s/files/1/0432/1122/7300/files/69494549568.pdf
    • https://cdn.shopify.com/s/files/1/0433/4492/0734/files/34083858744.pdf
    • https://cdn.shopify.com/s/files/1/0440/1335/5166/files/84155853803.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/dofupuz.pdf
    • https://cdn.shopify.com/s/files/1/0431/2337/6277/files/juratopasafokefifujogenat.pdf
    • https://cdn.shopify.com/s/files/1/0431/9484/3298/files/kivewubimaxuzibisaluxopu.pdf
    • https://cdn.shopify.com/s/files/1/0433/7106/9594/files/47354527307.pdf
    • https://cdn.shopify.com/s/files/1/0437/6897/1415/files/ovpn_configuration_file.pdf
    • https://cdn.shopify.com/s/files/1/0430/0043/0746/files/58136123949.pdf
    • https://cdn.shopify.com/s/files/1/0428/9177/2063/files/rujiw.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000547c.bin
e750b401b00f5e32b26fc3d47c22ad9f41a44eed697ceef5f88c26dd44435f17		 pdf-font-stream PDF embedded font (sfnt) at offset 0x547C 5636 bytes
font_01_sfnt_off000067a8.bin
70487d0c42c7d62dc73c3f98b489e24a6993100d3b8784fc545cd7f1aedbce81		 pdf-font-stream PDF embedded font (sfnt) at offset 0x67A8 10004 bytes
font_02_sfnt_off00008a0e.bin
df1d2c903cabdf2976887e260da0b25217edeb5ce2b71f315001024534e8e210		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8A0E 16060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.