Malicious PDF — malware analysis report

Static analysis result for SHA-256 6443be27a5fc1c6c…

MALICIOUS

PDF

64.6 KB Created: 2020-08-13 22:46:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 39c1e1d0c6643c490e4da29f48a1f2ce SHA-1: f01c459cde646d6655975e6dad64ec90ebf51327 SHA-256: 6443be27a5fc1c6c65d4f4d29b0905ca01042da8daa89a7595f1a8b391627e32
174 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links, many of which point to potentially malicious redirector infrastructure. The document body also contains a URL that appears to be a redirector. The heuristic 'SE_CALLBACK_LURE' indicates the document is designed to trick users into calling a phone number, likely for a scam. No scripts were extracted, but the presence of numerous links suggests an attempt to direct users to malicious sites or engage them in a phone-based scam.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=ayat+ruqyah+ustaz+sharhan
    • http://files.pottershousespringvalleyca.com/uploads/1/3/0/7/130775953/ee20b3bb23.pdf
    • http://lanadijig.kira-marie-mccullough.com/uploads/1/3/0/7/130776485/vidopo_gesapula_jamadufajidi.pdf
    • http://files.viktorcage.shop/uploads/1/3/1/4/131452961/7483206.pdf
    • http://files.sampsongigharbortherapy.com/uploads/1/3/1/6/131637257/9f3a166e32297aa.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0428/3600/0931/files/el_problema_del_alcoholismo.pdf
    • https://cdn.shopify.com/s/files/1/0434/5593/8725/files/kulukokezijalaze.pdf
    • https://cdn.shopify.com/s/files/1/0438/4607/4525/files/new_holland_service_manual.pdf
    • https://cdn.shopify.com/s/files/1/0431/5280/1943/files/befunifetipipodimokiwiven.pdf
    • https://cdn.shopify.com/s/files/1/0430/0311/7719/files/el_canto_triunfal_lldm.pdf
    • https://cdn.shopify.com/s/files/1/0429/7896/7703/files/62945320885.pdf
    • https://cdn.shopify.com/s/files/1/0433/0032/3478/files/lincoln_weld_pak_3200hd.pdf
    • https://cdn.shopify.com/s/files/1/0430/7812/3680/files/82481134182.pdf
    • https://cdn.shopify.com/s/files/1/0430/7917/2257/files/takudetegibirisora.pdf
    • https://cdn.shopify.com/s/files/1/0441/4429/6088/files/75041330390.pdf
    • https://cdn.shopify.com/s/files/1/0429/0124/2022/files/90901040999.pdf
    • https://cdn.shopify.com/s/files/1/0437/7640/9751/files/wudixewunirubun.pdf
    • https://cdn.shopify.com/s/files/1/0429/1756/0473/files/watermark_mac_os.pdf
    • https://cdn.shopify.com/s/files/1/0434/8998/4678/files/bangsamoro_basic_law_advantages_and_disadvantages.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000be4e.bin
34e05915428e9b32eb296d98a01a8a0fcd4a68d93db775b8e660b9a914133941		 pdf-font-stream PDF embedded font (sfnt) at offset 0xBE4E 5008 bytes
font_01_sfnt_off0000cf63.bin
2a96f289f9a39060db99d1284cd5de1a2067217a9a9ea468b7cae098e0b1f940		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCF63 11104 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.