Malicious PDF — malware analysis report

Static analysis result for SHA-256 6625e6e15bde0950…

MALICIOUS

PDF

47.8 KB Created: 2020-09-01 00:16:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a847d7b76f6ca6468887da110b7db161 SHA-1: d954c61dd59bbb9a37bdb36d812ffdda3e2a46d3 SHA-256: 6625e6e15bde0950d68e668aff635a864c8b39176c1494248ef44131f7e32132
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a deceptive lure for 'Lightroom 5 portrait presets free' which redirects to a malicious URL. It also functions as a link farm, embedding numerous links to external PDFs, likely for SEO manipulation or to host further malicious content. The ML classifier strongly indicates maliciousness, and the embedded links are a primary indicator of this attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=lightroom+5+portrait+presets+free
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://static.usrfiles.com/ugd/dfb5f8_eb3e805aa64a44fa991e85d947a6e699.pdf
    • https://static.usrfiles.com/ugd/b8c837_75479856e4f9424cb3a617519a938415.pdf
    • https://static.usrfiles.com/ugd/9374a7_d7bf84622c4c48689e7f2ba987410f6d.pdf
    • https://static.usrfiles.com/ugd/3be3a7_2def2bee03594875955ab61dbd4e0615.pdf
    • https://static.usrfiles.com/ugd/3fc21f_9600e419838b47cfb6715f0862f5ccaf.pdf
    • https://static.usrfiles.com/ugd/b8c837_31b9de4785a74f6d8c7e70ad1ce593df.pdf
    • https://static.usrfiles.com/ugd/dd4472_80a7c8ed6ab8473b8fa82f792df1a689.pdf
    • https://static.usrfiles.com/ugd/10b11f_04afe87fd3cb4a208c6c7bbae3d3568e.pdf
    • https://static.usrfiles.com/ugd/8b4172_0bd321acde72433f83582ef244154b00.pdf
    • https://cdn.shopify.com/s/files/1/0436/2010/6404/files/stalking_jack_the_ripper_vk.pdf
    • https://cdn.shopify.com/s/files/1/0435/9713/6030/files/takekogakaz.pdf
    • https://cdn.shopify.com/s/files/1/0428/6713/0534/files/61684194655.pdf
    • https://cdn.shopify.com/s/files/1/0440/6188/4568/files/zasigovabamo.pdf
    • https://cdn.shopify.com/s/files/1/0437/8440/5153/files/big_boss_air_fryer_manual.pdf
    • https://static.usrfiles.com/ugd/238140_bb37a53c316a436c9c94f9fa8cc7824c.pdf
    • https://static.usrfiles.com/ugd/590778_07d47064bbfb4fee8d0ad0ff86e4d4cd.pdf
    • https://static.usrfiles.com/ugd/6846fe_f356582b4a6f42438eb9ea8fa227e00a.pdf
    • https://static.usrfiles.com/ugd/b8c837_0615030b34e94baab4a6cb96bc143ad6.pdf
    • https://static.usrfiles.com/ugd/b8c837_1f2326bf082a4b47879fbc8d03a44528.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007cb0.bin
553ee9a8e47fbd3b267e233ef7c61e5f5350ea1b9fc95d0d6a82076ac8128b9e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7CB0 5348 bytes
font_01_sfnt_off00008ec0.bin
6ec4e888b8454357e372e47fa8d819786a9e635f40f561f1943227b42ee28a24		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8EC0 10256 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.