Malicious PDF — malware analysis report

Static analysis result for SHA-256 623caf8ada629ad6…

MALICIOUS

PDF

41.7 KB Created: 2020-08-31 12:41:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 51c5826d890f600413995b609b4f968d SHA-1: 8d154194f61e9d24b9352363074516a8f6a7377a SHA-256: 623caf8ada629ad6aeb0d794994c56a406669771884dc66ae8b40b5c5fae7006
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF was flagged by a machine learning classifier and heuristics indicate it contains a large number of external links, suggesting a link farm or SEO manipulation tactic. One of the embedded URLs, 'https://ttraff.ru/wix?keyword=%25C5%259Farlo+diktat%25C3%25B6r+t%25C3%25BCrk%25C3%25A7e+dublaj+izle', is identified as a known malicious redirector. The document body contains garbled text and embedded URLs, further supporting the malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=%25C5%259Farlo+diktat%25C3%25B6r+t%25C3%25BCrk%25C3%25A7e+dublaj+izle
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://static.usrfiles.com/ugd/49be48_6415e52d1e3e47b3a0c0c0326d1d5e2d.pdf
    • https://static.usrfiles.com/ugd/4b68be_1b54254551a14f258862fe4bd97955d3.pdf
    • https://static.usrfiles.com/ugd/05900a_1d9497bc47244c689c16c487aa865f1d.pdf
    • https://static.usrfiles.com/ugd/8dde66_4c5952f6272c49fa984da5e0199c847e.pdf
    • https://static.usrfiles.com/ugd/b8c837_ad9518ad5ca34f1688672623472346b6.pdf
    • https://cdn.shopify.com/s/files/1/0459/9899/7663/files/17702256829.pdf
    • https://cdn.shopify.com/s/files/1/0450/1897/2318/files/58828832843.pdf
    • https://cdn.shopify.com/s/files/1/0427/6443/5612/files/notujoparivuroxamiji.pdf
    • https://cdn.shopify.com/s/files/1/0428/0903/2863/files/54462602885.pdf
    • https://cdn.shopify.com/s/files/1/0438/2448/0416/files/19416253577.pdf
    • https://cdn.shopify.com/s/files/1/0433/5140/8799/files/carlos_castaneda_the_art_of_dreaming.pdf
    • https://cdn.shopify.com/s/files/1/0435/0361/6165/files/b._tech_syllabus_download.pdf
    • https://cdn.shopify.com/s/files/1/0464/9638/3128/files/48835834006.pdf
    • https://cdn.shopify.com/s/files/1/0429/2539/2035/files/23273989455.pdf
    • https://cdn.shopify.com/s/files/1/0435/7678/7103/files/73643660294.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004c36.bin
a6777b8667a5eb46cd0f4fd16c9744a5ac32fd4491a5131e4a0ba6ef61f973d1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4C36 5584 bytes
font_01_sfnt_off00005e9e.bin
4afff520af968023f80fcf8c8847672419c1b1b64f2213aa437151d1c4d8d1ec		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5E9E 10692 bytes
font_02_sfnt_off0000816e.bin
bf8c0df08d15f23cbe973db243b6e697da1e6bd06246bd760ca421b8c99065e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x816E 16404 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.