Malicious PDF — malware analysis report

Static analysis result for SHA-256 639e86ccadb58ae1…

MALICIOUS

PDF

43.1 KB Created: 2020-09-07 13:52:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1db2dde7903256bf4acd0029ca43b0a4 SHA-1: 42308c14e0839470609ebd2a471961c52b1d649e SHA-256: 639e86ccadb58ae1f3c850a42300b2c339fd41f0befebd6b344c71b7d0a5c3cb
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links, many of which point to a redirector infrastructure. The document body, though heavily obfuscated, contains a URL that leads to a known malicious redirector. This suggests an attempt to direct users to malicious content or phishing pages.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/wix?keyword=yuuki+mishima+confidant+guide
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://static.usrfiles.com/ugd/0779a3_933f256d4b574215b6242a544593c99a.pdf
    • https://static.usrfiles.com/ugd/6cf392_1b7abf75f5ab478cae9507cdf12e04b4.pdf
    • https://static.usrfiles.com/ugd/5be868_2e604e760308493095481cd7e1a1a97b.pdf
    • https://static.usrfiles.com/ugd/2f07a1_20bc8675fa5d44d88a61be05d472ab6a.pdf
    • https://static.usrfiles.com/ugd/9f6a24_4dbcf8464746466c88699453f1943e25.pdf
    • https://cdn.shopify.com/s/files/1/0431/3330/4981/files/importancia_de_las_energias_renovables.pdf
    • https://cdn.shopify.com/s/files/1/0433/5144/1560/files/gazufupiw.pdf
    • https://cdn.shopify.com/s/files/1/0440/6951/9510/files/interview_questions_and_answers_about_informal_sector.pdf
    • https://cdn.shopify.com/s/files/1/0432/6798/1476/files/aditivo_impermeabilizante_para_concreto.pdf
    • https://cdn.shopify.com/s/files/1/0434/9237/6741/files/45292864318.pdf
    • https://cdn.shopify.com/s/files/1/0432/3999/7595/files/blanche_neige_conte_court.pdf
    • https://cdn.shopify.com/s/files/1/0430/4715/7911/files/82938611979.pdf
    • https://cdn.shopify.com/s/files/1/0432/7224/1310/files/apollo_clinic_kolkata_online_reports.pdf
    • https://cdn.shopify.com/s/files/1/0431/6259/9583/files/92156622809.pdf
    • https://cdn.shopify.com/s/files/1/0433/8640/5022/files/36121689103.pdf
    • https://cdn.shopify.com/s/files/1/0435/1574/0312/files/73255245716.pdf
    • https://cdn.shopify.com/s/files/1/0432/7247/0686/files/11403795924.pdf
    • https://cdn.shopify.com/s/files/1/0456/8734/1215/files/gpg_dragon_box_manual.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006b6e.bin
cd23ab97e830621af572cb8e0f961530e8bbc88099284f4c8b9339b8a2d71b14		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6B6E 5332 bytes
font_01_sfnt_off00007d70.bin
b664d00f80322bc6a5a1ce55f619c98b78155878cdf2ed8af81083079002a4df		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7D70 10092 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.