Malicious PDF — malware analysis report

Static analysis result for SHA-256 635b7018d4baad30…

MALICIOUS

PDF

37.2 KB Created: 2020-08-30 19:44:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6bed00d10df9dee887348eacaed8b82a SHA-1: 1d22a522ca8b9546434b5ce8b4266509dbd501ac SHA-256: 635b7018d4baad30cec51cf74d10ac0584f427fe87951157db1c9f75f63bfb65
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link that redirects to a malicious URL, identified by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The document body, though heavily obfuscated, contains the same redirector URL and references to other PDF files, suggesting a link farm or redirection scheme. The ML classifier strongly indicated maliciousness, supporting the conclusion that this PDF is designed to lead users to harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=i+should+have+known+better+lyrics
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://static.usrfiles.com/ugd/aef5b7_6fa0d65a261e41089e5e2d5c67e3479c.pdf
    • https://static.usrfiles.com/ugd/eb6612_18b91ba81e02472e8a4f4c746846be9f.pdf
    • https://static.usrfiles.com/ugd/5ad03d_64913c45442b482596f55bf37960c6dd.pdf
    • https://static.usrfiles.com/ugd/49be48_fae08f3d6ace44d3b751c9a882b93555.pdf
    • https://static.usrfiles.com/ugd/286fb8_6728b376a9bd4fd480ef2fe34acb7c52.pdf
    • https://static.usrfiles.com/ugd/b8c837_c7603f3b730b4ec0a5627ef94f09ea5f.pdf
    • https://static.usrfiles.com/ugd/e33828_f86a469c2d324d61a05a8a5848d70c3e.pdf
    • https://static.usrfiles.com/ugd/c8a981_972b7e78f4d74ea99217e34f80690907.pdf
    • https://static.usrfiles.com/ugd/1f5cef_56eaf99da43a4d2e930b223a8fa1d488.pdf
    • https://static.usrfiles.com/ugd/be19e1_254d5df49d484cb0938ba7dab9429d72.pdf
    • https://static.usrfiles.com/ugd/067ecb_9ed0377180224e4a99299218e35e037a.pdf
    • https://static.usrfiles.com/ugd/c20ea7_0c0ef84e5d0849a790cc95cda6148052.pdf
    • https://static.usrfiles.com/ugd/ea9bdf_6a047b2202ce48b089f209669d4a6d72.pdf
    • https://static.usrfiles.com/ugd/b8c837_1e767dd5639445e2818aecc505d05f85.pdf
    • https://static.usrfiles.com/ugd/33a16d_4eb6b8c00bde4226b54a9664ef746e66.pdf
    • https://static.usrfiles.com/ugd/b8c837_f9ecb95da166493db45109e36c10740a.pdf
    • https://static.usrfiles.com/ugd/ac72e0_bf68ba96ecd7451597267da4229629a9.pdf
    • https://static.usrfiles.com/ugd/b8c837_9a260537d8644b40bfbab4801e197c7f.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004c62.bin
b711ffd66a0b25695987493dfeee3a5e38cf27c71eac2bad10c4c144c76ab222		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4C62 5424 bytes
font_01_sfnt_off00005edb.bin
5073a9f4a92d420e8ee8a14cab7d286cd30d50fa3ffbbf680cdf04498fb826d9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5EDB 13180 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.