Malicious PDF — malware analysis report

Static analysis result for SHA-256 6972fbf58784ecf0…

MALICIOUS

PDF

42.0 KB Created: 2020-08-10 07:23:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ea73aaf5cdf8a99828a8d3dfaeffe06b SHA-1: a7264fc47a0aa13a119bad0b0d56d493d839a35a SHA-256: 6972fbf58784ecf0362873322830e2a60180e5330f93c84a18f8823cbf69a026
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links, with at least one pointing to known malicious redirector infrastructure. The ML classifier also strongly indicated maliciousness. The document body, though heavily obfuscated, contains URLs that are consistent with a link farm or phishing lure. No scripts were extracted, but the primary attack vector appears to be the embedded links.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=afaan+oromoo+oduu+durii+pdf
    • http://files.farmhousefixer.com/uploads/1/3/1/1/131164324/sotedonazelesidox.pdf
    • http://files.ryanharrisdesign.com/uploads/1/3/1/0/131070918/534997.pdf
    • http://files.easyindonesian.com/uploads/1/3/2/6/132695620/kewosov-mujezuta-zesejodesiz-lolekesexe.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0433/7270/7990/files/xapasiduwano.pdf
    • https://cdn.shopify.com/s/files/1/0431/5486/6333/files/aprender_a_desenhar_corpo_humano.pdf
    • https://cdn.shopify.com/s/files/1/0430/7386/3842/files/thyristor_circuits.pdf
    • https://cdn.shopify.com/s/files/1/0431/3258/4098/files/68194934395.pdf
    • https://cdn.shopify.com/s/files/1/0433/7664/0156/files/fusitoriranefobomisoxe.pdf
    • https://cdn.shopify.com/s/files/1/0430/4925/5066/files/gusekasu.pdf
    • https://cdn.shopify.com/s/files/1/0437/2122/8440/files/cfop_method_for_beginners.pdf
    • https://cdn.shopify.com/s/files/1/0430/2536/7193/files/equations_of_straight_lines.pdf
    • https://cdn.shopify.com/s/files/1/0435/2350/6336/files/crompton_greaves_ceiling_fan_catalogue.pdf
    • https://cdn.shopify.com/s/files/1/0435/1423/2984/files/zalejuwi.pdf
    • https://cdn.shopify.com/s/files/1/0428/5369/5644/files/70971012614.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/gefoviliruvowej.pdf
    • https://cdn.shopify.com/s/files/1/0430/3123/2675/files/23253684051.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005cce.bin
51a331821c17ba067ca398d4b96849a3a531afc3e1f5baa72a0503111cbe48c2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5CCE 4968 bytes
font_01_sfnt_off00006d99.bin
cc74864b373dfc0cb4a084c8f51a62b5b6b6aac59357dacca32cd0f78cb7ce13		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6D99 2188 bytes
font_02_sfnt_off000077b7.bin
ed20586efdfeb150dfd9c2ddd09ea2a611890226a5075d17040ebc7eb0311b0b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x77B7 10180 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.