Malicious PDF — malware analysis report

Static analysis result for SHA-256 6178816463549005…

MALICIOUS

PDF

61.2 KB Created: 2020-08-22 01:28:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: cf5b0f43f027e52b4f3e8071e4dd53b0 SHA-1: 92f4258a03c31d16e390193747a5a6fb2ce481e2 SHA-256: 6178816463549005ec660654c864d8d11fc1f2d8f8dc24fee87aaa9df62dd355
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a significant number of embedded links, with one identified as a malicious redirector. The document body, though heavily obfuscated, also contains a URL pointing to a known malicious redirector. This suggests a campaign to drive traffic to malicious sites, potentially for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=narasimha+swamy+dj+songs
    • http://jufet.jewelryjunkywsherry.com/uploads/1/3/1/0/131070374/vakurijoxikuxupixu.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fedorahosted.org/lohit
    • https://cdn.shopify.com/s/files/1/0431/4886/9786/files/computer_hardware_and_software_in_english.pdf
    • https://cdn.shopify.com/s/files/1/0433/6815/3239/files/pimabadezo.pdf
    • https://cdn.shopify.com/s/files/1/0438/6743/9259/files/tanuranedozal.pdf
    • https://cdn.shopify.com/s/files/1/0440/8786/9592/files/6th_grade_adding_fractions_worksheet.pdf
    • https://cdn.shopify.com/s/files/1/0432/8495/5300/files/moodle_fcm_unl.pdf
    • https://cdn.shopify.com/s/files/1/0432/4291/3955/files/76024484710.pdf
    • https://cdn.shopify.com/s/files/1/0451/2792/5925/files/bus_119_nj_transit.pdf
    • https://cdn.shopify.com/s/files/1/0435/4136/4890/files/56322499607.pdf
    • https://cdn.shopify.com/s/files/1/0439/5044/0603/files/physiotherapy_for_lower_back_pain_exercise.pdf
    • https://cdn.shopify.com/s/files/1/0432/8026/9462/files/critical_role_stats_character_sheets.pdf
    • https://cdn.shopify.com/s/files/1/0433/0664/7717/files/tevurameradubotipafuje.pdf
    • https://cdn.shopify.com/s/files/1/0438/7602/4475/files/21506965398.pdf
    • https://cdn.shopify.com/s/files/1/0439/3048/4904/files/dibaromesoz.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005c9c.bin
0e01ebf5b6f190e4a24422ffb0ab90e1d2ed60668be2611c1c0c0c7d47cd6e16		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5C9C 5448 bytes
font_01_sfnt_off00006f17.bin
3d53bea906d255e14373ce3e606567c217ad95503c03adf5c3d7c2cf95fdd488		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6F17 7932 bytes
font_02_sfnt_off0000868f.bin
02499bd980b96c4f9f44b07784af1eaf6e26bd139d7a86b1a6bdd101d471519b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x868F 16556 bytes
font_03_sfnt_off0000aed0.bin
0d2b5ab6e3f5930c566ba03ab8a305ef2ff75acd9f2a883b06c364b263009319		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAED0 10268 bytes
font_04_sfnt_off0000d23d.bin
7348a63ea9206f1dd9d85ac5b8e77a4d6d13d552d707fc8209e912c0db264539		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD23D 16076 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.