Malicious PDF — malware analysis report

Static analysis result for SHA-256 7056bf09071cf7eb…

MALICIOUS

PDF

79.7 KB Created: 2020-09-08 19:01:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a9b02d9c3ff476bd61b7f3c4565ea731 SHA-1: 500d70c74efa61a98f3c731a3ce0a9bbd40ffbc5 SHA-256: 7056bf09071cf7ebda9e4fc34644c4fa77ea739d8a59af5de4d9feea21b39ced
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link to a known malicious redirector, which is designed to lead users to further malicious content. The heuristic PDF_SEO_LINK_FARM indicates a large number of outbound links, suggesting a link farm or SEO poisoning attempt. The ML classifier also strongly flagged this PDF as malicious. The embedded URL is likely intended to trick users into clicking it, potentially leading to a malware download or phishing site.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/wix?keyword=take+five+quartet+sheet+music
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://static.usrfiles.com/ugd/575363_55a6fa151342407c84d208bbbc17a9fb.pdf
    • https://static.usrfiles.com/ugd/11f207_2a7fc40b73374b59bda4db1a73e84887.pdf
    • https://static.usrfiles.com/ugd/0dd040_cebbbfa8101747ed94b3fd7f84fed303.pdf
    • https://static.usrfiles.com/ugd/40b9e6_8ee6f128756e4872b0b929b0ccfffaf4.pdf
    • https://cdn.shopify.com/s/files/1/0427/7505/2454/files/79798035576.pdf
    • https://cdn.shopify.com/s/files/1/0431/7839/3762/files/john_wick_chapter_2_1080p_torrent.pdf
    • https://cdn.shopify.com/s/files/1/0431/9769/4109/files/74409523803.pdf
    • https://cdn.shopify.com/s/files/1/0431/9150/0961/files/7990631010.pdf
    • https://cdn.shopify.com/s/files/1/0429/6874/4087/files/regrow_hair_protocol_free_download.pdf
    • https://static.usrfiles.com/ugd/c268f7_1359dfc820604d40a074f579ede6e009.pdf
    • https://static.usrfiles.com/ugd/e4d7df_2623802ba9844c54a5df290901b7a68c.pdf
    • https://static.usrfiles.com/ugd/d51d36_f3bed7f09863437c9dd7062061c208c9.pdf
    • https://static.usrfiles.com/ugd/5ea691_b4066cc7bf674d5a93ed9b9dbb5b26b8.pdf
    • https://static.usrfiles.com/ugd/a382ee_7d288fe859d74a54888e53a755655668.pdf
    • https://static.usrfiles.com/ugd/3f0e57_1610b804d38142caaa9f1a02f1a3a190.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e409.bin
4a778beb3ac978a33689a3638d8eb157b9aafd8022f766d60585666bd093ab01		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE409 5288 bytes
font_01_sfnt_off0000f5f0.bin
76365d3657f15e5fb89dc64fb07f88d13f5fc34ba5658ab3ea6cf939ce38ba17		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF5F0 11128 bytes
font_02_sfnt_off00011bdc.bin
9f27e75a407aae3e0ed4fcb011868272987752e72574b260d32fa4ee18e16702		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11BDC 16188 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.