Malicious PDF — malware analysis report

Static analysis result for SHA-256 65935cdc7c4127e2…

MALICIOUS

PDF

53.5 KB Created: 2020-08-05 23:53:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3c3bca38ef74db730646637ebad05a81 SHA-1: 44408c9f8b81246fee89a1069226678daae12198 SHA-256: 65935cdc7c4127e22ccfe86d4ce5aaf2e08c7ad2aec01c793e02ba24a162d977
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a link farm and a specific malicious redirector URL, indicating an attempt to lead the user to harmful content. The ML classifier strongly flagged this PDF as malicious. The primary IOC is the redirector URL, which is likely used to obscure the final destination of the malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=bisection+method+in+c+pdf
    • http://files.lymanproductions.com/uploads/1/3/1/0/131070597/8103172.pdf
    • http://files.nikkileahdesigns.com/uploads/1/3/0/8/130874110/gunaleti_fesigovuros_dipap_zutix.pdf
    • http://files.nctfconcealment.com/uploads/1/3/1/8/131856308/tariwiwezel.pdf
    • http://files.goodbyechristianwhore.com/uploads/1/3/1/3/131380889/netapuv.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0432/0142/9662/files/85876178129.pdf
    • https://cdn.shopify.com/s/files/1/0436/5962/4606/files/chromatography_multiple_choice_questions.pdf
    • https://cdn.shopify.com/s/files/1/0439/9998/5822/files/finatiramenurewi.pdf
    • https://cdn.shopify.com/s/files/1/0431/1102/2756/files/jig_boring_machine.pdf
    • https://cdn.shopify.com/s/files/1/0430/2631/7473/files/lonely_island_jack_sparrow_lyrics.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/nidosavexurirevinuno.pdf
    • https://cdn.shopify.com/s/files/1/0435/2134/3647/files/kagetubitefumefijezovaxu.pdf
    • https://cdn.shopify.com/s/files/1/0432/0005/3408/files/55196601539.pdf
    • https://cdn.shopify.com/s/files/1/0428/3020/0991/files/94603953095.pdf
    • https://cdn.shopify.com/s/files/1/0431/2429/3796/files/30547975418.pdf
    • https://cdn.shopify.com/s/files/1/0440/8924/5861/files/37449257966.pdf
    • https://cdn.shopify.com/s/files/1/0435/0581/1608/files/buguguxovovugosaxef.pdf
    • https://cdn.shopify.com/s/files/1/0432/9072/2472/files/palapevogosirepizel.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000762e.bin
576dd8b5dbb64fff537d980faa1f6753d137747ca0b31bbaeb5ee3af99c40270		 pdf-font-stream PDF embedded font (sfnt) at offset 0x762E 5104 bytes
font_01_sfnt_off0000876e.bin
91adf6cae8738371196fe92178b07cc72c2e1986277b1236aac845987455f786		 pdf-font-stream PDF embedded font (sfnt) at offset 0x876E 13552 bytes
font_02_sfnt_off0000b385.bin
9def142226f437a2ba4283d976d890154c0e2dbb92bc97532184205699c6e9c0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB385 16148 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.