Malicious PDF — malware analysis report

Static analysis result for SHA-256 6c7041031ad28d67…

MALICIOUS

PDF

77.9 KB Created: 2020-09-08 03:13:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6f4db97cb9de74c73748f4fe5b17c0bd SHA-1: fe6cc5ef48352a2bdd8d70f0140b53c22671e589 SHA-256: 6c7041031ad28d67bd36bd3970d6b5ab8027a006a526106149f8f41ac2190415
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains embedded links, one of which points to a known malicious redirector. The document body, though heavily obfuscated, contains a URL that appears to be the same as the malicious redirector, suggesting an attempt to trick users into visiting a malicious site. The presence of numerous other links to benign Shopify PDFs indicates a potential link farm or SEO manipulation tactic to disguise the malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=alt+character+codes+pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0431/9795/6256/files/49587946907.pdf
    • https://cdn.shopify.com/s/files/1/0446/1549/9939/files/ardenas_1944_antony_beevor.pdf
    • https://cdn.shopify.com/s/files/1/0429/6943/2230/files/aludecor_acp_shade_card.pdf
    • https://cdn.shopify.com/s/files/1/0431/9713/7056/files/95745608547.pdf
    • https://cdn.shopify.com/s/files/1/0432/6277/1366/files/analytical_biochemistry_and_separation_techniques.pdf
    • https://static.usrfiles.com/ugd/ce5d00_e83241e89392460298fbf0b37d3c375f.pdf
    • https://static.usrfiles.com/ugd/607883_b32436d0b19347c0b64cd187fe43e67e.pdf
    • https://static.usrfiles.com/ugd/6dcf04_f154edd0693c4db28101482d70f010fb.pdf
    • https://static.usrfiles.com/ugd/8acad3_8a5c71df9182429fafda7dd2ab792e0f.pdf
    • https://static.usrfiles.com/ugd/a8ca0f_265540af0487421f8020abe8a945b9dd.pdf
    • https://cdn.shopify.com/s/files/1/0440/6332/6358/files/mips_bubble_sort.pdf
    • https://cdn.shopify.com/s/files/1/0438/0996/4192/files/after_effects_templates_free_cc_2017.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000a95d.bin
20443cfaafdddf8d5701b947b9c91138580ac774f8f2ee3eb6de4fc6b805e50a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA95D 5232 bytes
font_01_sfnt_off0000bb25.bin
169e5f86dd2f94a9bbe328dbf4e2f56c29bbedf0d12d81de08013feb988e0224		 pdf-font-stream PDF embedded font (sfnt) at offset 0xBB25 28532 bytes
font_02_sfnt_off00010bc9.bin
896d3237d84f5b4ac9a2c61ecd33be4b394a0fdf456747b7edaf744fdfeb7c4e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10BC9 13648 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.