Malicious PDF — malware analysis report

Static analysis result for SHA-256 6bc1acb86948c364…

MALICIOUS

PDF

50.6 KB Created: 2020-08-31 02:45:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b2a29e33a654e178300131352efd08cd SHA-1: 22131597cd5e6d4f5d4024c8abb9a9639dfa21e0 SHA-256: 6bc1acb86948c364103d110c2efc7ccd5d4e8838ea772e7369bd700a54a21057
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains embedded links, with one identified as a malicious redirector. The document body, though partially garbled, includes text suggesting a lure related to a 'school farewell anchoring script', and the presence of numerous external PDF links indicates a link farm strategy. The ML classifier strongly flagged this PDF as malicious, supporting the assessment of a phishing or scam attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/wix?keyword=anchoring+script+for+school+farewell
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://fedorahosted.org/lohit
    • https://static.usrfiles.com/ugd/b8c837_c0812bb7e82e41c58e9700235dc98bac.pdf
    • https://static.usrfiles.com/ugd/b8c837_b06a2d3d25fc4f509533f5b8e18b48a4.pdf
    • https://static.usrfiles.com/ugd/0aab01_965d8e1e54934f6faaa7b5fe4722489b.pdf
    • https://static.usrfiles.com/ugd/8b49c6_06e492b400264aa4a001c715b9889adf.pdf
    • https://static.usrfiles.com/ugd/dba42a_c2e41e81b5f44e7386ff3acdaea72e55.pdf
    • https://static.usrfiles.com/ugd/10e3af_5a660d19afb54164a53cf0ac26298879.pdf
    • https://cdn.shopify.com/s/files/1/0428/1355/4855/files/lepumogaf.pdf
    • https://cdn.shopify.com/s/files/1/0430/3332/9817/files/xameg.pdf
    • https://cdn.shopify.com/s/files/1/0464/7046/3646/files/wuvexabu.pdf
    • https://cdn.shopify.com/s/files/1/0434/5892/0605/files/19616153160.pdf
    • https://static.usrfiles.com/ugd/67e251_95927aa10a3d40e881100c957ce82845.pdf
    • https://static.usrfiles.com/ugd/405339_d2f3cc64bc2846de9a0a801530339395.pdf
    • https://static.usrfiles.com/ugd/08fe48_60b50077af994bc5b8b071622e7fe0e3.pdf
    • https://static.usrfiles.com/ugd/87a178_5006b80ec07f4c4193de36920ff76569.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006626.bin
b86d96842740aeb9613a21fb5ce3e1e95eb074dcc661502eb69992bf701b2392		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6626 5148 bytes
font_01_sfnt_off000077a5.bin
1e7a967bd6e938ef356a629ab491fb1a7e8f104f3f864c8c3ce0219a5c3f3086		 pdf-font-stream PDF embedded font (sfnt) at offset 0x77A5 9976 bytes
font_02_sfnt_off000099d1.bin
b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x99D1 4324 bytes
font_03_sfnt_off0000a7d2.bin
d79c9a132589a1cbaa375d0395e889c5227cec89cc69e9921f450bd5f71d0a54		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA7D2 5796 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.