Malicious PDF — malware analysis report

Static analysis result for SHA-256 7102a415f16ef149…

MALICIOUS

PDF

50.9 KB Created: 2020-09-02 00:05:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a93b7d8150afc14c226551eebcfac4ac SHA-1: 02a2666c3774cf492206a5c89a9305481c534e5b SHA-256: 7102a415f16ef1497974e47b7e852a0bd362caada28eb0249a7ff6a79450dd3d
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a link farm designed to redirect users to malicious infrastructure, specifically identified by the critical PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The ML classifier also strongly indicated maliciousness. The primary IOC is the redirector URL, which is likely used to host or deliver further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=composite+functions+worksheet+igcse
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://static.usrfiles.com/ugd/a1fb72_396d46e68a244bd59bae198e22a8890c.pdf
    • https://static.usrfiles.com/ugd/cb4a18_f4f4c87488714b33977d5eecd627cdb9.pdf
    • https://static.usrfiles.com/ugd/b8c837_53686dd539794b55860797b7d42ce3b6.pdf
    • https://static.usrfiles.com/ugd/bfbc46_40fb62c9515048eda17e392549fd60dc.pdf
    • https://static.usrfiles.com/ugd/902d29_20316faeeae446ffa5bf03464de346c6.pdf
    • https://static.usrfiles.com/ugd/b8c837_dc9f5a679e1948a0bc660624708cd1f4.pdf
    • https://static.usrfiles.com/ugd/5ecadc_b8983508d4c4490a844a3f09e3d70781.pdf
    • https://static.usrfiles.com/ugd/856cea_5d6c0a214621451194efb1bcb7c2e9f4.pdf
    • https://static.usrfiles.com/ugd/3794ad_b9a34127ab0546e192d313649a991aa5.pdf
    • https://cdn.shopify.com/s/files/1/0434/7507/5225/files/kavenibodupeduvu.pdf
    • https://cdn.shopify.com/s/files/1/0440/5451/1766/files/membrane_transport_concept_map_answer_key.pdf
    • https://cdn.shopify.com/s/files/1/0438/8922/9979/files/zikexazu.pdf
    • https://cdn.shopify.com/s/files/1/0432/8862/5302/files/1202753303.pdf
    • https://static.usrfiles.com/ugd/5b5da7_2522f561435b43c39147694f6a1e5712.pdf
    • https://static.usrfiles.com/ugd/4b874d_e0c6e4181e1e44b284e45b7709dc7c9c.pdf
    • https://static.usrfiles.com/ugd/9e53d4_f0e2438738e147a1b117a7c8c0744efe.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005ba9.bin
d57ddf4e9afcd60ad9183230781e2a51d939cde0f7953f6b0b5adacede01fbce		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5BA9 5248 bytes
font_01_sfnt_off00006d6d.bin
7a84c6cf4f46d4bac8fb6ba896b1cdf686c60a6b9912cc82b79a416172af7d16		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6D6D 3128 bytes
font_02_sfnt_off00007a2e.bin
29700e17337ab727291ddadd2d2c3f69a51f67ea66471d8da437a631b6e01f65		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7A2E 14100 bytes
font_03_sfnt_off0000a73a.bin
04da5c4f3502a20cc87988b67df201e15d3ee20f8554056e7efcaa25b0d9ec54		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA73A 16556 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.