Malicious PDF — malware analysis report

Static analysis result for SHA-256 7557add2f4fe6680…

MALICIOUS

PDF

58.4 KB Created: 2020-08-21 13:09:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b74e36e9cb56aff0cf9aa3b03055c63b SHA-1: 42d1ea837f5a019bb1251002cdf586399d8493c4 SHA-256: 7557add2f4fe66801fced5bcff3cc6ddf1a0a4966db4101f3df7980298b2320a
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains embedded links, with one specifically pointing to a known malicious redirector. The document body, though heavily obfuscated, contains text fragments that appear to be lures, such as 'dbrau date sheet 2019 ba 1st year'. The presence of numerous external PDF links, many hosted on Shopify, suggests a link farm designed to obscure the ultimate destination and potentially host further malicious content. The ML classifier strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=dbrau+date+sheet+2019+ba+1st+year
    • http://lekaluvo.peppermintcinema.com/uploads/1/3/0/8/130874642/dozepigiwowal.pdf
    • http://wabera.kmkbooks.com/uploads/1/3/2/6/132681670/29762efd1e75.pdf
    • http://zekadete.alphatrucksolutions.com/uploads/1/3/1/6/131606228/bc291ce.pdf
    • http://wopol.affordablestoragebrownfield.com/uploads/1/3/1/4/131406390/kisolawiki.pdf
    • https://cdn.shopify.com/s/files/1/0435/6187/7663/files/wegob.pdf
    • https://cdn.shopify.com/s/files/1/0434/3729/3718/files/listino_borsa_merci_bologna.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/vevisip.pdf
    • https://cdn.shopify.com/s/files/1/0438/4541/9173/files/ap_sachivalayam_study_material_in_telugu.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/84113106953.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/30551251375.pdf
    • https://cdn.shopify.com/s/files/1/0434/1117/7639/files/aws_dumps.pdf
    • https://cdn.shopify.com/s/files/1/0430/9850/5369/files/denepilupomozexubuwop.pdf
    • https://cdn.shopify.com/s/files/1/0438/5672/4128/files/dikigeboran.pdf
    • https://cdn.shopify.com/s/files/1/0444/1374/7367/files/cpr_aha_guidelines_2017.pdf
    • https://cdn.shopify.com/s/files/1/0427/7246/3772/files/nuvured.pdf
    • https://cdn.shopify.com/s/files/1/0432/4166/8775/files/korut.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000738d.bin
c4107d886596f32dac4af1469309c9e859409f41543ccc09d808bac8e9e87fc1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x738D 5604 bytes
font_01_sfnt_off0000868c.bin
4910d0177da9f60ecc92c13a34fae8c5c38ffafb9e4e22a3c3fd987548b79157		 pdf-font-stream PDF embedded font (sfnt) at offset 0x868C 6148 bytes
font_02_sfnt_off0000966c.bin
70af27576150cc673495c5b264e02b48af3e385c41cc0fcd33b33bef19d534ea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x966C 9876 bytes
font_03_sfnt_off0000b889.bin
55a2adcdde0823aff53a8418bfa06ea4a1afb62f77263365b5231babc5cb08da		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB889 11160 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.