Malicious PDF — malware analysis report

Static analysis result for SHA-256 68a764f8a51116a0…

MALICIOUS

PDF

57.2 KB Created: 2020-08-07 13:26:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d082f99422f2aa5ee827c493224d809e SHA-1: 713355c1ff4ed2a0c44d78438306b82e758b076d SHA-256: 68a764f8a51116a0a584cd3cff43b5bcb082c0c90a6f2863c61fd57e0849fc6a
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous links to external resources, with one critical heuristic identifying a link to known malicious redirector infrastructure. The document body, though heavily obfuscated, contains text that appears to be a lure for educational materials. The presence of many external PDF links suggests a link farm or SEO manipulation tactic to distribute malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=cambridge+primary+mathematics+stage+4+teacher+s+resource+pdf
    • http://vofaliziv.counter-recruit.org/uploads/1/3/1/8/131871980/gefepumerozujozukugu.pdf
    • http://files.workwithstandout.com/uploads/1/3/1/4/131437487/gagodalov.pdf
    • http://files.puremsm.com/uploads/1/3/1/8/131871593/xelanoluw-reseletorivo-sijokufi.pdf
    • http://files.stincrowvoden.com/uploads/1/3/1/0/131069978/bafefeludebosib.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0433/9014/0581/files/juduvi.pdf
    • https://cdn.shopify.com/s/files/1/0434/8333/2772/files/72092386590.pdf
    • https://cdn.shopify.com/s/files/1/0432/0044/6626/files/tosesosozajatowoluvali.pdf
    • https://cdn.shopify.com/s/files/1/0432/4841/8971/files/39476116897.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/90840236881.pdf
    • https://cdn.shopify.com/s/files/1/0432/4235/6904/files/java_script_countdown.pdf
    • https://cdn.shopify.com/s/files/1/0429/7926/2615/files/neopets_site_themes.pdf
    • https://cdn.shopify.com/s/files/1/0433/6196/0091/files/75553300895.pdf
    • https://cdn.shopify.com/s/files/1/0429/7369/2063/files/ramilabometobodoguzizux.pdf
    • https://cdn.shopify.com/s/files/1/0428/1267/0111/files/l_argumentation_juridique_stefan_goltzberg.pdf
    • https://cdn.shopify.com/s/files/1/0438/3988/1373/files/milusewenosiw.pdf
    • https://cdn.shopify.com/s/files/1/0435/6079/6318/files/8063249862.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000968a.bin
1e0558e699e8f0fece7d31ec846157b6160825c3306a6bc17e9ca07ac23686ff		 pdf-font-stream PDF embedded font (sfnt) at offset 0x968A 5772 bytes
font_01_sfnt_off0000aa0d.bin
8bd8b1937212488d947ba2718916f912ad447fb8d09a946921222c71bb912914		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAA0D 14044 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.