Malicious PDF — malware analysis report

Static analysis result for SHA-256 77139d80ddae5f48…

MALICIOUS

PDF

70.1 KB Created: 2020-08-12 13:16:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6a0785a08ec65f9da6458c93c41bf05b SHA-1: a8c9d544333121fc86c5311917c0767d0d7743c8 SHA-256: 77139d80ddae5f4894a9128ee09bed19dee7317f59f81c4bf9130c9e830d11a0
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links, with one identified as a malicious redirector. The document body, though heavily obfuscated, also contains the URL to the malicious redirector. This suggests the primary purpose is to lure users to malicious sites, potentially for phishing or malware distribution. No scripts were extracted, but the presence of numerous links points to a link-farming or redirection attack.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=crpc+bare+act+pdf+in+marathi
    • http://makonorim.artfeltcollaborative.com/uploads/1/3/1/4/131408103/voxazewafe-jemolixelam.pdf
    • http://vometu.easystreetproductions.biz/uploads/1/3/0/8/130814769/3379541.pdf
    • http://fizetek.theopentrunkyyc.com/uploads/1/3/0/8/130814168/9012791.pdf
    • http://files.hollingsworthlumber.com/uploads/1/3/1/3/131398360/0b365aff8b.pdf
    • http://larugazet.serenamariewilliams.com/uploads/1/3/1/4/131483281/9e96dadd40a.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fedorahosted.org/lohit
    • https://cdn.shopify.com/s/files/1/0431/3671/2861/files/mapamokimojetaseded.pdf
    • https://cdn.shopify.com/s/files/1/0428/9753/9231/files/michigan_form_5080.pdf
    • https://cdn.shopify.com/s/files/1/0432/0470/6464/files/vodakane.pdf
    • https://cdn.shopify.com/s/files/1/0432/5956/0086/files/nagokobudemokedowe.pdf
    • https://cdn.shopify.com/s/files/1/0429/9993/9235/files/75005999135.pdf
    • https://cdn.shopify.com/s/files/1/0437/1637/8773/files/zufufalixepofobekixibuni.pdf
    • https://cdn.shopify.com/s/files/1/0436/2049/9616/files/japunemofemi.pdf
    • https://cdn.shopify.com/s/files/1/0432/4638/7362/files/49286752114.pdf
    • https://cdn.shopify.com/s/files/1/0452/2960/5024/files/food_list_for_diabetics_type_2.pdf
    • https://cdn.shopify.com/s/files/1/0433/1126/7990/files/35668973931.pdf
    • https://cdn.shopify.com/s/files/1/0437/0441/8455/files/88165383330.pdf
    • https://cdn.shopify.com/s/files/1/0435/8501/1871/files/snake_cool_math_games.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ae3f.bin
dd7b880f1c6958317b71933e3175eb4154b1281d355b69180e4ce829e506ee21		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAE3F 2828 bytes
font_01_sfnt_off0000b839.bin
d47f6629c88ac394b015dc3868c451f6a342a31f0e1a38daefda0f4817e12c54		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB839 5232 bytes
font_02_sfnt_off0000c9c4.bin
2ede282234dc1c49fbe88cdf5bd6d5117f1dfd90f44eb734155ba7350c8d9c6e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC9C4 10316 bytes
font_03_sfnt_off0000ed30.bin
af4ffb08cd9d9a9ca825da1a8bdc2b30910bdd3086e760d1196e426a4376880e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xED30 8068 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.