Malicious PDF — malware analysis report

Static analysis result for SHA-256 764b8eb614ef5c23…

MALICIOUS

PDF

43.5 KB Created: 2020-08-04 06:40:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ca4f2bd5128e1b17c344bdd63899d181 SHA-1: dd7dc168eee58ed92f70e8b4ef54f9d9915147f8 SHA-256: 764b8eb614ef5c237804204f63a358670980ad8551a2d57db7de3abe6ca626f3
194 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF contains a link farm and a redirector URL, indicating an attempt to lead the user to malicious content. The heuristic 'SE_BROWSER_INSTALL_LURE' suggests the document's content is designed to trick the user into installing something, likely malware or a malicious browser extension. The ML classifier strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=convergys+technical+support+interview+questions+and+answers+pdf
    • http://files.approfessionals.us/uploads/1/3/0/7/130738894/c5deca.pdf
    • http://files.ruthbeachink.com/uploads/1/3/0/7/130775666/kefemusa_fudomidurivus_wanubexilus_demiwi.pdf
    • http://files.bedfordnhcert.org/uploads/1/3/2/6/132682528/xatojafago.pdf
    • http://files.nickpateras.org/uploads/1/3/2/7/132710655/d914f150ae.pdf
    • http://files.berberraftingadventures.com/uploads/1/3/1/3/131398091/7dcfc36.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0432/7034/0772/files/daxelexebovow.pdf
    • https://cdn.shopify.com/s/files/1/0432/2381/0203/files/dotixixub.pdf
    • https://cdn.shopify.com/s/files/1/0428/0962/2687/files/lagujefixikogilonijegoso.pdf
    • https://cdn.shopify.com/s/files/1/0435/9965/9176/files/17587670176.pdf
    • https://cdn.shopify.com/s/files/1/0446/6461/9171/files/canon_poweshot_s2_is.pdf
    • https://cdn.shopify.com/s/files/1/0430/7802/5370/files/fegeriwalosodarewedovaloz.pdf
    • https://cdn.shopify.com/s/files/1/0429/4960/7590/files/fatopogunudawadi.pdf
    • https://cdn.shopify.com/s/files/1/0432/8462/7616/files/49480096173.pdf
    • https://cdn.shopify.com/s/files/1/0427/9762/9596/files/kutojor.pdf
    • https://cdn.shopify.com/s/files/1/0431/2743/9526/files/18394381949.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/52135332303.pdf
    • https://cdn.shopify.com/s/files/1/0438/2621/7120/files/ohio_department_of_education_report_cards.pdf
    • https://cdn.shopify.com/s/files/1/0437/3492/5463/files/18487166055.pdf
    • https://cdn.shopify.com/s/files/1/0436/4782/8133/files/sosajamugowidubupo.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006896.bin
3d6485052e5125b6b3d4372f7f64ed73f7afa22e65dbe315e0bc624865f2e2b9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6896 5700 bytes
font_01_sfnt_off00007c0e.bin
cc3d099ed1c09faf2248fdedf36ae348f7f868709cb53754b33b9dc187d272ee		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7C0E 10660 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.