Malicious PDF — malware analysis report

Static analysis result for SHA-256 6a9bf08de6dedacc…

MALICIOUS

PDF

57.5 KB Created: 2020-07-25 23:34:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: afe2bb88da619e091e325753dc8e4d4b SHA-1: a6f1547c6a15f7c1ba62a7e5f80c01a2fea4da3e SHA-256: 6a9bf08de6dedacc5c64fb597756d76b8cbd6644361df01442740e33c7ea000a
194 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF contains a SE_PAYMENT_REDIRECT_LURE heuristic firing, indicating it attempts to trick users with fake financial instructions. It also features a PDF_MALICIOUS_REDIRECTOR_LINK heuristic pointing to a suspicious URL, likely used for phishing or malware distribution. The presence of a link farm suggests an attempt to manipulate search engine results or distribute content broadly.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LURE
    Document describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=calculator+hide+apps
    • http://files.desertrambler.com/uploads/1/3/2/6/132682030/dubozeri_sevepizabumu.pdf
    • http://files.catleeart.com/uploads/1/3/1/4/131453221/8513342.pdf
    • http://files.aliceannephotography.com/uploads/1/3/0/7/130739699/dilak_wisokafu.pdf
    • http://files.ruralcostabrava.com/uploads/1/3/1/3/131383823/5646701.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0430/5689/0013/files/10328812934.pdf
    • https://cdn.shopify.com/s/files/1/0431/5506/2948/files/biwow.pdf
    • https://cdn.shopify.com/s/files/1/0430/0763/9711/files/21809401569.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/5081520916.pdf
    • https://cdn.shopify.com/s/files/1/0431/2009/9488/files/67643927485.pdf
    • https://cdn.shopify.com/s/files/1/0433/6805/4949/files/17410079139.pdf
    • https://cdn.shopify.com/s/files/1/0432/3095/3627/files/ronun.pdf
    • https://cdn.shopify.com/s/files/1/0433/6517/1354/files/98903073684.pdf
    • https://cdn.shopify.com/s/files/1/0433/4783/7083/files/51822759454.pdf
    • https://cdn.shopify.com/s/files/1/0432/1103/0683/files/sofevekipuxoda.pdf
    • https://cdn.shopify.com/s/files/1/0432/3193/6674/files/jebikalufireritef.pdf
    • https://cdn.shopify.com/s/files/1/0433/1179/2286/files/nitasoxek.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008377.bin
b103532c52da853e87418e7e308e218043ceb9da8a78f4104eaf6aa24d06ac3c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8377 4960 bytes
font_01_sfnt_off0000945c.bin
98de79b297e3797e740cfbde3538a37bcda84e2cac2672723d669a8421f405b8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x945C 2012 bytes
font_02_sfnt_off00009d93.bin
55db8daab50dca45a1f5f2f4faf52f7a0d28e9457518eb6d6b1f697634297768		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9D93 10360 bytes
font_03_sfnt_off0000c140.bin
940587323d1947cc4b80e71b5b4e07368006354cf7486a89facd564ccfbbb5f6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC140 16664 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.