Malicious PDF — malware analysis report

Static analysis result for SHA-256 673acfa4f28b53f5…

MALICIOUS

PDF

66.4 KB Created: 2020-08-30 12:13:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bfab55c335796f5a70fa9c8f63d3bea1 SHA-1: 7bb051e9a0a83431544e4ef5e0685bf3f9bf77da SHA-256: 673acfa4f28b53f5dd169033a79e44f1e7e1ca0922aa0a47b71112f0a13b32a3
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous links, with one identified as a malicious redirector pointing to 'https://ttraff.com/wix?keyword=11.+s%25C4%25B1n%25C4%25B1f+kimya+modern+atom+teorisi+notlar%25C4%25B1'. The document body, though heavily obfuscated, contains text related to academic notes and the malicious URL. The presence of a link farm heuristic suggests an attempt to manipulate search engine results, likely to distribute malicious content or phish users.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=11.+s%25C4%25B1n%25C4%25B1f+kimya+modern+atom+teorisi+notlar%25C4%25B1
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://static.usrfiles.com/ugd/74c34a_5cf6842778d84dc3bed3d2255cbdfc48.pdf
    • https://static.usrfiles.com/ugd/760101_7775fcc5ea154297b283967f78f63bd1.pdf
    • https://static.usrfiles.com/ugd/b8c837_edaa6cb7a74a450c919441e89df33d72.pdf
    • https://static.usrfiles.com/ugd/77d535_0bcbce3905ef45f59de7bdf0d6eb387e.pdf
    • https://static.usrfiles.com/ugd/b8c837_c60d65537eb74b61a35721d0745921d9.pdf
    • https://static.usrfiles.com/ugd/b8c837_5e124e27a9ad40eaa2c231729b4f7778.pdf
    • https://static.usrfiles.com/ugd/6924eb_e10440aa7d444c2fb68557ad86748d21.pdf
    • https://static.usrfiles.com/ugd/ca32a8_97059718c2f3422bb21245323aee18c7.pdf
    • https://cdn.shopify.com/s/files/1/0440/3019/7925/files/paperlessemployee_com_target.pdf
    • https://cdn.shopify.com/s/files/1/0429/7441/2949/files/fortescue_beach_fishing_report.pdf
    • https://cdn.shopify.com/s/files/1/0438/2438/2114/files/lubaralirunis.pdf
    • https://cdn.shopify.com/s/files/1/0440/0830/8901/files/companions_baldur_s_gate.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000aab1.bin
7de888e44ffb5e34b0b5632d5b60970ccc58cd29d9e00c4f8ad56ade75981154		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAAB1 2884 bytes
font_01_sfnt_off0000b4ef.bin
1166a336c81e79a9cfea71a6f150671a43fc96ec492a2d0e16f505db6ed533b3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB4EF 5028 bytes
font_02_sfnt_off0000c5f2.bin
20b659d276c6d8802b5425a276f00366d4bb3823c67b7226dcf5b8ebbea5452c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC5F2 12000 bytes
font_03_sfnt_off0000eb56.bin
1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEB56 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.