Malicious PDF — malware analysis report

Static analysis result for SHA-256 711b3307a36b5333…

MALICIOUS

PDF

59.3 KB Created: 2020-08-18 15:16:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 93eb4f0ad3ceca24702bb1fb8fea3d2d SHA-1: ee68b3033987ea9f195a62befe15913015f1adae SHA-256: 711b3307a36b5333824e1cd451f5597d1de496d860934ef4053b1ecec0b3c1d1
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links, with one identified as a malicious redirector. The document body, though heavily obfuscated, contains URLs that appear to be part of a link farm or SEO spam campaign. The ML classifier strongly indicated maliciousness, supporting the conclusion that this PDF is designed to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=busuu+pro+apk+onhax
    • http://files.stteathpreschool.com/uploads/1/3/1/0/131070331/bawoso.pdf
    • http://files.poisonivy-designs.com/uploads/1/3/0/7/130775998/bc34d9c.pdf
    • http://gibikadax.izasfaceups.com/uploads/1/3/0/8/130814328/2954735.pdf
    • http://files.theglovelock.com/uploads/1/3/0/8/130814855/sexere-zowejovumose-vujujukuw-fonogigarala.pdf
    • http://files.juantp.com/uploads/1/3/1/4/131437029/fozim.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0427/4061/3286/files/tupizodakovoguguvi.pdf
    • https://cdn.shopify.com/s/files/1/0432/5385/8472/files/2186335266.pdf
    • https://cdn.shopify.com/s/files/1/0431/7180/7394/files/todusetomulapefewodigalek.pdf
    • https://cdn.shopify.com/s/files/1/0429/7211/9199/files/c_programming_language_in_tamil.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/75278808376.pdf
    • https://cdn.shopify.com/s/files/1/0427/6954/7431/files/99922060491.pdf
    • https://cdn.shopify.com/s/files/1/0447/0718/4793/files/sail_trim_telltales_guide.pdf
    • https://cdn.shopify.com/s/files/1/0427/7361/0663/files/tetesefawi.pdf
    • https://cdn.shopify.com/s/files/1/0440/6745/5128/files/gungeon_knife_shield.pdf
    • https://cdn.shopify.com/s/files/1/0429/8165/4679/files/mugaditifavolixi.pdf
    • https://cdn.shopify.com/s/files/1/0440/2262/8502/files/mawowu.pdf
    • https://cdn.shopify.com/s/files/1/0431/0476/4068/files/72316833669.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/xigidewepiwunabifaw.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006e40.bin
975fc812df1db66840587a273181022ac99a0d637760cb27cf2db120abab8ee6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6E40 5056 bytes
font_01_sfnt_off00007f6b.bin
b72d7ced80d1fc1f315d528171703ffd58205ee5a6133f04fc4e8fe8bb47398c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7F6B 15680 bytes
font_02_sfnt_off0000a31a.bin
1dc43089f2d9aef4e60643e29a52a147335241b899c0fbc4336a63e841766a2c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA31A 10852 bytes
font_03_sfnt_off0000c841.bin
18c0e33279dda91e8e22ee0c9dcb4ae24f84515aafa8400833e64dcd463b953b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC841 16616 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.