Malicious PDF — malware analysis report

Static analysis result for SHA-256 75ea95de7d09572f…

MALICIOUS

PDF

46.5 KB Created: 2020-08-05 17:19:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c583aa9df050e3a4f804ca07a91b2490 SHA-1: e06512ec35a1af88dace10d4bafb516aab6e4ddf SHA-256: 75ea95de7d09572ff7fed8dea164e3e7164c576a8f67a1d835fff4b4816846db
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links, many of which point to a link farm designed to distribute malicious content. The primary URL, https://ttraff.cc/pify?keyword=presente+simple+en+ingles+ejemplos+pdf, is identified as a malicious redirector. The document body, though heavily obfuscated, contains references to the topic 'Presente simple en ingles ejemplos pdf', likely a lure to encourage clicks on the malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=presente+simple+en+ingles+ejemplos+pdf
    • http://files.joyful-spirit-church.org/uploads/1/3/1/4/131482954/raxokujetudigubuto.pdf
    • http://files.flintrockfarm.com/uploads/1/3/1/1/131164205/8286916.pdf
    • http://files.escondidoartassociation.com/uploads/1/3/2/7/132710683/xivuxejisel_molapexuxapamad.pdf
    • http://files.thewaterexchange4life.com/uploads/1/3/1/6/131636725/1287274.pdf
    • http://files.431775997417950473.com/uploads/1/3/2/6/132682646/ea99fe5713.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0436/3363/9584/files/nitemowilezarogibujuf.pdf
    • https://cdn.shopify.com/s/files/1/0431/2127/9137/files/85708235851.pdf
    • https://cdn.shopify.com/s/files/1/0434/3015/0309/files/zozoma.pdf
    • https://cdn.shopify.com/s/files/1/0430/2707/1127/files/goturugeso.pdf
    • https://cdn.shopify.com/s/files/1/0434/4601/0022/files/62250756595.pdf
    • https://cdn.shopify.com/s/files/1/0434/2690/6264/files/4777277485.pdf
    • https://cdn.shopify.com/s/files/1/0430/0177/4233/files/golokexikujusajowega.pdf
    • https://cdn.shopify.com/s/files/1/0433/2696/3865/files/funozuvigapod.pdf
    • https://cdn.shopify.com/s/files/1/0429/5429/3402/files/rixupadi.pdf
    • https://cdn.shopify.com/s/files/1/0436/8983/6697/files/beretta_92fs_owners_manual.pdf
    • https://cdn.shopify.com/s/files/1/0436/0932/5730/files/dezabumasufuwega.pdf
    • https://cdn.shopify.com/s/files/1/0434/4646/8769/files/install_npm_mac.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007533.bin
9501dd0042d453b1db94ce0172f46e40df135f355a375ad37cc4a4f86cd685b1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7533 5228 bytes
font_01_sfnt_off000086ee.bin
9b8a44c4f84415f5b3cdfce4e77a0815b8b07f616a45a663ab956710fc654ff5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x86EE 11088 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.