Malicious PDF — malware analysis report

Static analysis result for SHA-256 6ea3d50800fcb58c…

MALICIOUS

PDF

52.8 KB Created: 2020-08-10 05:41:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 516e071238e1d34bf9332dee3eabab54 SHA-1: 33b9f0404a912c8b0ad22bb7195078e42440db9c SHA-256: 6ea3d50800fcb58c0a895c4837a251ae145987e522e8592cde965fe6e4cb6dda
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded links, including one pointing to a known malicious redirector. The document body, though heavily obfuscated, contains text suggesting a lure related to a 'Bangladesh railway application form'. The presence of many external PDF links indicates an attempt to distribute further malicious content or engage in SEO manipulation for malicious purposes. No scripts were extracted, but the embedded links are the primary indicators of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=bangladesh+railway+application+form+pdf
    • http://files.net.fruklas.com/uploads/1/3/0/8/130874125/b47d38f0de81d.pdf
    • http://files.kcmga.com/uploads/1/3/1/4/131410009/zilotal.pdf
    • http://files.b3risksolutions.com/uploads/1/3/0/9/130969083/3723413.pdf
    • http://files.briansartofcreation.com/uploads/1/3/0/8/130873708/dugoberoduroxupekuwo.pdf
    • http://files.solacedominic.org/uploads/1/3/1/4/131454581/c7cad48529b32c9.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0432/5546/4104/files/zuratewinukumu.pdf
    • https://cdn.shopify.com/s/files/1/0430/7802/5377/files/rekulipafumapolodaripabik.pdf
    • https://cdn.shopify.com/s/files/1/0435/6558/0437/files/10824416036.pdf
    • https://cdn.shopify.com/s/files/1/0433/6055/1070/files/nerexuwib.pdf
    • https://cdn.shopify.com/s/files/1/0431/0240/4769/files/wekavif.pdf
    • https://cdn.shopify.com/s/files/1/0435/9487/5039/files/tasirajumoretazalobedider.pdf
    • https://cdn.shopify.com/s/files/1/0429/6186/2810/files/89182959650.pdf
    • https://cdn.shopify.com/s/files/1/0431/5440/7580/files/37418202832.pdf
    • https://cdn.shopify.com/s/files/1/0429/5111/4908/files/vexipok.pdf
    • https://cdn.shopify.com/s/files/1/0433/8040/8474/files/48392477152.pdf
    • https://cdn.shopify.com/s/files/1/0430/3038/0698/files/dexotusubuzamu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNU
    • http://www.gnu.org/copyleft/gpl.htmRegular

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000066ca.bin
971592d2791c62d68569ed9ad313f7cf722c90d275f9219a9a1c802595beb23e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x66CA 5812 bytes
font_01_sfnt_off00007a7f.bin
3b1b5c782683e58d42fb30d0dff300c5736a7fe3caa1b4f6f79d2f43a31a8bd9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7A7F 11748 bytes
font_02_sfnt_off0000a094.bin
11b85a03df0f311cc3ff841abd8d57a71b894e0c83bf5623f9466c8d658b68ff		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA094 11380 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.