Malicious PDF — malware analysis report

Static analysis result for SHA-256 6089b835901fe9b0…

MALICIOUS

PDF

55.4 KB Created: 2020-09-06 04:50:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 676f764c1d846d27f9b714e73626a253 SHA-1: f3a20bf76654f4713efa12d7219fe3fffce72e93 SHA-256: 6089b835901fe9b0f666ce92d99ee431f9a787be5735192b1ac41330fdddf08b
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains embedded links that point to a known malicious redirector. The heuristic 'PDF_MALICIOUS_REDIRECTOR_LINK' and the ML classifier 'ML_NYX_PDF_MALICIOUS' strongly indicate malicious intent. The document body itself contains obfuscated text and URLs, suggesting an attempt to lure users to malicious content, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=jorge+amado+capit%25C3%25A3es+de+areia+pdf
    • https:///t.co/XU9SOJLOrj-DISC
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://static.usrfiles.com/ugd/0c268c_7ac5c317e1d64607acd126690e9fa885.pdf
    • https://static.usrfiles.com/ugd/784815_f79df01a3f6f402f99cc7935babcc5d6.pdf
    • https://static.usrfiles.com/ugd/0b46e6_fa1f1f4bb674469fa241a43d9d99c05d.pdf
    • https://static.usrfiles.com/ugd/69695d_a8884367a5d74a38b0ee3138308f8f9b.pdf
    • https://static.usrfiles.com/ugd/69b86f_42b51fb909144a1bab592956e1ed5bff.pdf
    • https://static.usrfiles.com/ugd/74a852_8deee0a714e943efb68bac6ba977c3aa.pdf
    • https://static.usrfiles.com/ugd/8b97dd_296c2fb6079749deaf57e209d5a919d3.pdf
    • https://static.usrfiles.com/ugd/704566_5c83778283cc4c6aa09c519207d9b017.pdf
    • https://static.usrfiles.com/ugd/822ecd_33e44aaca64b4a5185a492786babb0fd.pdf
    • https://static.usrfiles.com/ugd/b8c837_e245a8f5366e467db6a07c1330258ae8.pdf
    • https://static.usrfiles.com/ugd/a13bc2_b222eacad40942f2934ed82a0ed6c2cc.pdf
    • https://static.usrfiles.com/ugd/0994f9_f4e303d0eb64419db9778f42aba04b0f.pdf
    • https://static.usrfiles.com/ugd/b7ed05_d0ae65759f1a4171a9d2e953fc25ae86.pdf
    • https://static.usrfiles.com/ugd/9cc572_945a2606a2e8444baa6890698d9ec6ba.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000066fe.bin
db382f381da3ccb1f11b6693922143bbe686333cb72fe8dd91bc6b1b9e913c30		 pdf-font-stream PDF embedded font (sfnt) at offset 0x66FE 3136 bytes
font_01_sfnt_off00007234.bin
70abfc3ca29dce0d34dd596b39430fad532a72575265446c764d58dd729b29cd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7234 5752 bytes
font_02_sfnt_off00008524.bin
811b61a9377ac9b4cff8a0c08533f3d63f4c1d9c2418169b997424eb7d0b863a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8524 17808 bytes
font_03_sfnt_off0000b76e.bin
3504051f7c5bcd862f6294ec32b6155ee799369ac18bfeb4edaba82064d59ac9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB76E 16300 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.