Malicious PDF — malware analysis report

Static analysis result for SHA-256 5e70ff2da8d49a4a…

MALICIOUS

PDF

67.5 KB Created: 2020-08-14 10:50:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 07a37556c2c6faca12c83fbb39568d97 SHA-1: 22019a08077cc6b43a8dbece2ce43611f4dc0c5d SHA-256: 5e70ff2da8d49a4ad371f1931c4c589579bf02d33f2716dcbb84717627f48a32
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links, many of which point to a redirector service known for malicious activity. The ML classifier also strongly indicated maliciousness. The primary malicious IOC is the redirector URL, which is likely used to funnel victims to further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=d%2526+d+guide+book+pdf
    • http://files.shindigpublishing.com/uploads/1/3/0/9/130969172/lemewotuna.pdf
    • http://files.jps-page.com/uploads/1/3/0/7/130739369/dipomakezakovu_gadomemogusasem_janafexozunir.pdf
    • http://files.accentcreateevents.com/uploads/1/3/2/6/132683289/367376ae09a.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0432/3019/9966/files/finaluzikovave.pdf
    • https://cdn.shopify.com/s/files/1/0439/4047/9131/files/basic_calculus_grade_12_textbook_pdf.pdf
    • https://cdn.shopify.com/s/files/1/0431/4189/0209/files/anatomy_of_kidney_download.pdf
    • https://cdn.shopify.com/s/files/1/0440/1197/8902/files/18796018266.pdf
    • https://cdn.shopify.com/s/files/1/0436/7931/8166/files/anamika_academy_maths.pdf
    • https://cdn.shopify.com/s/files/1/0437/9358/0181/files/aoac_official_method_996._06.pdf
    • https://cdn.shopify.com/s/files/1/0438/5135/0166/files/wegusanafisuwan.pdf
    • https://cdn.shopify.com/s/files/1/0440/5297/1685/files/1996_buick_century_service_manual.pdf
    • https://cdn.shopify.com/s/files/1/0434/1415/9521/files/22070191285.pdf
    • https://cdn.shopify.com/s/files/1/0433/4842/6902/files/2178590885.pdf
    • https://cdn.shopify.com/s/files/1/0432/1270/1854/files/97018346975.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000066ce.bin
77db61ef5180589f8aa115641cb2bd4aea57415b2070ee90626b0d4e29fde502		 pdf-font-stream PDF embedded font (sfnt) at offset 0x66CE 6596 bytes
font_01_sfnt_off00007713.bin
a5b279f02d72b9a9f90a20f4d0ea34bc529691a211e0332fc8c824e18e1de280		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7713 3148 bytes
font_02_sfnt_off00008252.bin
a3981bb475cc2143a1b59c8dfce73a49efc35ef5c21f75579f29bf6c691813b6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8252 4156 bytes
font_03_sfnt_off0000903f.bin
5b9628e4dce825d9a75eb6ecfd2f53d6044f55cd2d2d1f787b33c43dc16d3c67		 pdf-font-stream PDF embedded font (sfnt) at offset 0x903F 6224 bytes
font_04_sfnt_off00009f65.bin
8a21effd6f14e6932d8f64b258371a031afd143b2878b2aba42d89f307bd8a92		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9F65 20276 bytes
font_05_sfnt_off0000dac2.bin
44769919e113f321e71240e0f7da55f1f3a365acef9016667d5dbee46ef85b1e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDAC2 16304 bytes
font_06_sfnt_off0000f085.bin
36dcc78f411c2832d0472dfb32fd1967f1fd3bc111a02bc080a5c7cfbccae074		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF085 6096 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.