Malicious PDF — malware analysis report

Static analysis result for SHA-256 695032c1c16afb71…

MALICIOUS

PDF

166.3 KB Created: 2020-09-17 00:23:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 02b11c35eb7b6a568594d089dce9d0f0 SHA-1: 90022a79c267af5d69f03cf455c4b420cf32508e SHA-256: 695032c1c16afb7168e6d690220fbdf14947db271a17a532f2e299537cc84719
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains an embedded URL that points to a known malicious redirector. This suggests the document is part of a phishing or malware distribution campaign, likely delivered as a spearphishing attachment. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=star+arcana+persona+3+portable+male
    • http://rejijed.art-of-rude.com/uploads/1/3/2/7/132740292/dafurebuxularovug.pdf
    • http://fubafapax.malcolmmacdonaldoutlawford.com/uploads/1/3/0/8/130813829/1007337.pdf
    • http://files.ottaart.com/uploads/1/3/0/7/130775516/8339e035cdca86a.pdf
    • http://files.lougiansante.org/uploads/1/3/1/4/131453124/jeraretet.pdf
    • http://files.waltshotrodshop.com/uploads/1/3/1/4/131453348/1867429.pdf
    • http://fizoroti.andreavargasportfolio.com/uploads/1/3/1/3/131384635/sojuzelukuge.pdf
    • http://files.manikkrealm.com/uploads/1/3/0/9/130969206/2924324.pdf
    • http://files.vacworld.net/uploads/1/3/0/7/130740458/luralebiwum.pdf
    • http://files.artofmichaelnguillen.com/uploads/1/3/0/9/130969811/42f9f.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://98ba7302-872c-4e9b-8acc-655765f0a63f.filesusr.com/ugd/ac8c68_a28e55d97eee464f8b15f8fb60bbbc06.pdf?index=true
    • https://266090ff-a053-42e4-a15a-d83395ba3d3f.filesusr.com/ugd/fe83c3_b9965e83d790445fba30e9d45a5cf388.pdf?index=true
    • https://f0218d1e-607e-4bec-b981-a1dd78d2cee1.filesusr.com/ugd/4bb894_8bd37692371744afb278a6cc398697f3.pdf?index=true
    • https://b93aa6cc-4c7f-4817-b466-2ee927b19e9a.filesusr.com/ugd/3826db_7e2101f8cfb5454791131afa3e817558.pdf?index=true
    • https://dc5e0ae5-8e7e-4120-bfed-b22d97f5f1ad.filesusr.com/ugd/ca32a8_f8c4c2a7714d4194b392d78d1b3cd519.pdf?index=true
    • https://cdn.shopify.com/s/files/1/0431/5486/6333/files/capacity_assessment_form_2.pdf
    • https://cdn.shopify.com/s/files/1/0432/2829/9428/files/python_language_pdf_file_download.pdf
    • https://cdn.shopify.com/s/files/1/0439/0433/6040/files/piraf.pdf
    • https://cdn.shopify.com/s/files/1/0430/7143/9001/files/gta_san_andreas_pc_cheats_txt.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000184d7.bin
b38f72f1aea5247f92699d0c56d5cbce39449a927ac185342003cbcbc82be127		 pdf-font-stream PDF embedded font (sfnt) at offset 0x184D7 69320 bytes
font_01_sfnt_off0002542d.bin
0953a2ce5ca98c736ac4e8c6538f9516527e7d30a4a511ce42bcd8cfaa7977d9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2542D 5484 bytes
font_02_sfnt_off000266b6.bin
fa61899f45884660a1e86ea82794ddcee242a1824b19eee0201556c9558549b3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x266B6 10624 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.