Malicious PDF — malware analysis report

Static analysis result for SHA-256 65dabc79c6de963e…

MALICIOUS

PDF

56.5 KB Created: 2020-08-31 05:56:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9d936be67f1a53280bc197ef71eebce1 SHA-1: 32ac7156f83bdc116c2d538b9df01b2cf219f897 SHA-256: 65dabc79c6de963efe927b843d05d85df0cd977f0b597abf880ab6d4e7bc9737
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a large number of embedded links, many of which point to a redirector URL. The document body, though heavily obfuscated, contains the primary malicious URL. This suggests the document is designed to act as a link farm, likely to distribute malware or phish for credentials by directing users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=sunbeam+mini+sewing+machine+bobbin+p
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://static.usrfiles.com/ugd/10b11f_1c40250952a54d358ea58254583c6330.pdf
    • https://static.usrfiles.com/ugd/c75f60_a7bba16f39fa429b9e6554a0ace4615c.pdf
    • https://static.usrfiles.com/ugd/9b7d8a_ab19e79ced114217abe88de0ab37cb81.pdf
    • https://static.usrfiles.com/ugd/83e24f_889d3264a2674d6796307636d1bc4e2b.pdf
    • https://static.usrfiles.com/ugd/b8c837_28e3e3daad48408fa536b1a636621400.pdf
    • https://static.usrfiles.com/ugd/3eed2b_355232eb317d4c3da72e922c5d2e8f03.pdf
    • https://static.usrfiles.com/ugd/daca0d_0e87707bcb6a4d209f4555605c9e7590.pdf
    • https://static.usrfiles.com/ugd/99965f_c6445bf5f0484704a70c6303119922ab.pdf
    • https://static.usrfiles.com/ugd/affaa6_f068569b296d4be98c75c293b0db2b37.pdf
    • https://static.usrfiles.com/ugd/4c76bf_6e0340ac93a84e0e842f620c6f52c44f.pdf
    • https://static.usrfiles.com/ugd/a640e9_dee30920f2714ae1a1643969e269a583.pdf
    • https://static.usrfiles.com/ugd/c63dba_f707563fa780496b90ab516c7fa82ea9.pdf
    • https://static.usrfiles.com/ugd/b8c837_f1537bbddb36496ba8d58b19bf8e11e4.pdf
    • https://static.usrfiles.com/ugd/3e87bf_2a1e4dc845704a9ba3a29a443ebe44ca.pdf
    • https://static.usrfiles.com/ugd/8dde66_af59c8e3335e4811b6bfbd8980a685de.pdf
    • https://static.usrfiles.com/ugd/7198c1_0b52a5fa59854f4e9af02b5887d0f518.pdf
    • https://static.usrfiles.com/ugd/6908d7_6c14039658764e32adb94a32019f5fdf.pdf
    • https://static.usrfiles.com/ugd/b8c837_19e593bc5c9b4d1da50ad1c063c1cd0a.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000983a.bin
9b6ec91214a42a83b08e5b2e66f9a971c3dbdff6bb5c9c0a247c58612396f6a7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x983A 5552 bytes
font_01_sfnt_off0000ab06.bin
9274941060964df42f874b590a2949ca472950bb05c8592c6a9ad54a24409f10		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAB06 13144 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.