Malicious PDF — malware analysis report

Static analysis result for SHA-256 65799bd17a5765cf…

MALICIOUS

PDF

48.1 KB Created: 2020-09-17 02:38:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0464252186bd31bdaf34e362595d3801 SHA-1: 7c3cdf5f1601701b18f1e1b5c8bd877d0367159e SHA-256: 65799bd17a5765cfe9c1608ec4c96b8b1214b1dd44fe42dd9f33bdff79f70221
194 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded links, with one specifically identified as a malicious redirector. The document body, though heavily obfuscated, contains text that, when combined with the heuristic 'SE_ADVANCE_FEE_SCAM_LURE', suggests a scam. The primary malicious URL is a redirector that likely leads to further malicious content or phishing pages.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/wix?keyword=coda+2020+conference+on+data+analysis
    • http://xojalimu.coachmicheleevents.com/uploads/1/3/1/1/131164312/8515122.pdf
    • http://jukifuben.normansignsanddesigns.com/uploads/1/3/0/7/130739873/dc58a0.pdf
    • http://tigeluko.mistystevensbluegrass.net/uploads/1/3/1/3/131383483/2620353.pdf
    • http://files.woodstovemulledwine.com/uploads/1/3/1/6/131606758/2006387.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://c4f02167-d1f1-416a-8391-49f2d7c2d9d9.filesusr.com/ugd/28146e_553f0ddceb7d487cade2fd1669ffc69b.pdf?index=true
    • https://f7695350-ddd2-43ff-8353-f6d86c7d6727.filesusr.com/ugd/f17c08_34ac353791a14cb99a7a763bab62e374.pdf?index=true
    • https://e3c9d32f-7849-430f-96e9-49b810cfdf15.filesusr.com/ugd/003b86_793dab6867d34de5b49ee6488415ce92.pdf?index=true
    • https://5073ecb5-de6b-4da6-93c3-bef75053cb73.filesusr.com/ugd/c1de29_a428be5fbb5b4f4d8bb66195fe971114.pdf?index=true
    • https://bda0ccd0-af68-4cfb-9a62-6cd1e85dba57.filesusr.com/ugd/9757e7_7ceeb3e990d7448a825cdf7a34c4b2fe.pdf?index=true
    • https://81f7ae72-e87e-4e6b-a0bc-b78927246be5.filesusr.com/ugd/0aab01_83d757d358cd4db985869bdce13b7bc1.pdf?index=true
    • https://c565bedc-c9de-429c-a778-e593acfb1241.filesusr.com/ugd/9e41f0_e8d4ad26eae548c58c47a91def48e861.pdf?index=true
    • https://2d4a09e2-6de5-4ebe-976d-b20c53fd3c9d.filesusr.com/ugd/2f8cea_325e0d4a12934dcd8b32e2e354fd285b.pdf?index=true
    • https://82a10bb9-9381-4430-9448-8d89329cc811.filesusr.com/ugd/b8c837_a79e8818eb6145cdb191c55709b7a691.pdf?index=true
    • https://77df711d-4242-420d-b9c8-7ceb4711e060.filesusr.com/ugd/c8df25_7d91719de5e94bbc90c729b940b240ed.pdf?index=true
    • https://60f167a5-e247-4062-bbbc-2017e0448328.filesusr.com/ugd/31bf02_d00c31a9456343b98e846e7f13518e9c.pdf?index=true
    • https://e65eda69-8cca-481f-8943-d73378768e92.filesusr.com/ugd/6f58fb_b11aca2161e44e2f85bb762883db138a.pdf?index=true
    • https://dc2947a0-c59f-4f4f-9968-ffc9038b5a53.filesusr.com/ugd/fd30ac_b1310fbd7c724d89ab2dc00decd57c34.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007dc9.bin
b59b71068420b71d329ec58a0090801acf399379bf9d3b4ea6b5f8f00882e6d0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7DC9 5296 bytes
font_01_sfnt_off00008fdf.bin
2c8266ec6ef22c7a8a4867a7c6892830913663c04553de7b0d3ea6b1a2107013		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8FDF 10396 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.