Malicious PDF — malware analysis report

Static analysis result for SHA-256 71434a0e5d4c8d26…

MALICIOUS

PDF

51.7 KB Created: 2020-08-14 06:56:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: cab0436d04f6a7bb0befe152fb4b677e SHA-1: 4287668dde34bfda83413a427c7189cbef8f70d2 SHA-256: 71434a0e5d4c8d2692f9a11e4284447e521310db03f1370e88f3680cf63a149d
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links, with one identified as a malicious redirector. The document body, though heavily obfuscated, contains text related to 'latex document class report section numbering' and the malicious URL, suggesting a lure to a phishing or malware distribution site. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=latex+document+class+report+section+numbering
    • http://dawam.artandeyecandy.com/uploads/1/3/2/7/132712461/9905477.pdf
    • http://files.victorystrengthandfitness.net/uploads/1/3/1/4/131482915/6471630.pdf
    • http://dumewe.martin-watzinger.com/uploads/1/3/1/3/131384536/d85b50b83.pdf
    • http://karowofaw.oldguardofwestchester.org/uploads/1/3/2/6/132681947/4554133.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://cdn.shopify.com/s/files/1/0443/8307/6518/files/camry_manual_transmission.pdf
    • https://cdn.shopify.com/s/files/1/0435/2425/9992/files/padunune.pdf
    • https://cdn.shopify.com/s/files/1/0440/7663/0181/files/bt_cotton_project.pdf
    • https://cdn.shopify.com/s/files/1/0437/4416/6037/files/africa_agenda_2020.pdf
    • https://cdn.shopify.com/s/files/1/0431/3877/7249/files/xewogarifixuzusen.pdf
    • https://cdn.shopify.com/s/files/1/0432/6640/8603/files/salient_features_of_payment_of_bonus_act_1965.pdf
    • https://cdn.shopify.com/s/files/1/0440/7584/3736/files/assessment_strategies_and_tools.pdf
    • https://cdn.shopify.com/s/files/1/0432/1135/8372/files/49035321884.pdf
    • https://cdn.shopify.com/s/files/1/0439/5981/2254/files/ias_sociology_optional_syllabus.pdf
    • https://cdn.shopify.com/s/files/1/0439/5512/6430/files/three_categories_of_human_rights.pdf
    • https://cdn.shopify.com/s/files/1/0446/2968/8483/files/caballo_de_troya_3_espaol.pdf
    • https://cdn.shopify.com/s/files/1/0434/7327/2992/files/28799401460.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007a69.bin
b800302cdb95c9f805c6cec3085666c2561b4311ad04fb0c86a7720ead39105a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7A69 5424 bytes
font_01_sfnt_off00008cc0.bin
869817bb63f7785416f4f77ea7ac9e240c13abdbde2b3c73081540c060612e68		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8CC0 11840 bytes
font_02_sfnt_off0000b365.bin
d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB365 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.