Malicious PDF — malware analysis report

Static analysis result for SHA-256 648e50c0879ade73…

MALICIOUS

PDF

44.7 KB Created: 2020-08-04 07:03:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7ffeb26522ee433220ed16ecaf1e1a24 SHA-1: db19ee7fe815fd2b9ae244107884c78a71341a1a SHA-256: 648e50c0879ade73c7fba4210746b13438b576e07901ed822b7003e62d4ec6a3
162 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a lure related to "History of money book pdf" and embeds numerous links, with one redirecting to known malicious infrastructure. The heuristic firings indicate this PDF is malicious and likely part of a link farm designed to distribute further malicious content. While no scripts were extracted, the presence of multiple embedded URLs and the ML classification strongly suggest malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wb?keyword=history%20of%20money%20book%20pdf
    • http://files.claytonbrowneortho.com/uploads/1/3/2/3/132302960/1f0ad16.pdf
    • http://files.physicswiley.com/uploads/1/3/1/4/131407737/5152480.pdf
    • http://files.ildiamon.com/uploads/1/3/1/6/131606111/a90c50c.pdf
    • http://files.wiseowlwellnessclub.com/uploads/1/3/1/3/131380850/mixobufarudemar.pdf
    • http://guxur.diamondskillsacademy.com/uploads/1/3/0/7/130738615/mogejaxomosemosolo.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0437/5802/6903/files/81163625691.pdf
    • https://cdn.shopify.com/s/files/1/0431/4903/3627/files/remove_bleed_and_crop_marks_from.pdf
    • https://cdn.shopify.com/s/files/1/0432/3803/1518/files/gobulovuvimuwi.pdf
    • https://cdn.shopify.com/s/files/1/0431/3966/1981/files/xosivugimesefuvesud.pdf
    • https://cdn.shopify.com/s/files/1/0434/1720/6946/files/63801555337.pdf
    • https://cdn.shopify.com/s/files/1/0429/9508/9559/files/12030087209.pdf
    • https://cdn.shopify.com/s/files/1/0431/8937/1029/files/sewatureb.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/70354855800.pdf
    • https://cdn.shopify.com/s/files/1/0434/5479/1846/files/55656076770.pdf
    • https://cdn.shopify.com/s/files/1/0433/1339/7913/files/49281755109.pdf
    • https://cdn.shopify.com/s/files/1/0429/9299/2410/files/take_five_piano_accompaniment.pdf
    • https://cdn.shopify.com/s/files/1/0433/4059/5352/files/53755850372.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007041.bin
7cd622b4fa6d1ffce1183786d54fcd1f469a08035d318c47efbb1d28817eb294		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7041 5212 bytes
font_01_sfnt_off000081e9.bin
436f4fce0f6d34c06072b6ae355c19ea992492ab400fccb7b416d5955a8e17bb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x81E9 10524 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.