Malicious PDF — malware analysis report

Static analysis result for SHA-256 7630a637ecfb6944…

MALICIOUS

PDF

54.7 KB Created: 2020-08-27 15:17:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b334a5aad00bce6c61b590b6ffaa6b70 SHA-1: 5f9fad9c84ded032cb9dd1aa0b751b487353ee5e SHA-256: 7630a637ecfb69449172ee769205223f8c39208682bfdcb038356574156a2afb
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains multiple embedded links, with one identified as a malicious redirector. The heuristic PDF_MALICIOUS_REDIRECTOR_LINK and PDF_SEO_LINK_FARM indicate a pattern of linking to potentially harmful or spam-related content. The ML classifier also strongly flagged this PDF as malicious. The primary IOC is the redirector URL, which is likely used to funnel victims to further malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=valoracion+de+silverman+anderson
    • http://labupe.skidayz.co/uploads/1/3/0/9/130969723/raremibovolib.pdf
    • http://fenuzit.flyingchangesequestrian.com/uploads/1/3/1/4/131406082/1547538.pdf
    • http://fontawesome.iohttp://fontawesome.io/license/
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0435/8556/8923/files/13516489074.pdf
    • https://cdn.shopify.com/s/files/1/0434/3159/2102/files/722863182.pdf
    • https://cdn.shopify.com/s/files/1/0432/5769/2320/files/2430111866.pdf
    • https://cdn.shopify.com/s/files/1/0430/4817/3722/files/titozitoda.pdf
    • https://cdn.shopify.com/s/files/1/0432/2027/1264/files/pufedabiba.pdf
    • https://cdn.shopify.com/s/files/1/0432/4111/1712/files/fenexovasexapavasele.pdf
    • https://cdn.shopify.com/s/files/1/0430/0426/4602/files/astronomy_scribd.pdf
    • https://cdn.shopify.com/s/files/1/0430/7048/8730/files/walmart_bingo_game_sheet.pdf
    • https://cdn.shopify.com/s/files/1/0432/6978/3720/files/jose_maria_arguedas_obras_completas.pdf
    • https://cdn.shopify.com/s/files/1/0432/2400/6820/files/50309456992.pdf
    • https://cdn.shopify.com/s/files/1/0438/5511/8501/files/pafos.pdf
    • https://cdn.shopify.com/s/files/1/0434/0645/9029/files/22358804452.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00009072.bin
4d3fb6748bdbfc0676bbc246a341b567ec3707c335db72ae26270b639488ab50		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9072 1684 bytes
font_01_sfnt_off000098d6.bin
d9748d3008581d82ac72e07bfb9e0e29aeda088456e083c5e050cc191e5bd377		 pdf-font-stream PDF embedded font (sfnt) at offset 0x98D6 5112 bytes
font_02_sfnt_off0000aa22.bin
d0971c60e33ca6c3b70f3a9ba927f34843c8c502603aa9cac8edd1121a3f5746		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAA22 10480 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.