Malicious PDF — malware analysis report

Static analysis result for SHA-256 7782bd5f2b06ae73…

MALICIOUS

PDF

42.1 KB Created: 2020-09-14 06:10:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0506b60fd6ace3a7053c87eec1468b16 SHA-1: 59f6f0ea3d387442b506fe58c2e862cbd2fd7112 SHA-256: 7782bd5f2b06ae7396b4544cb33db15be4719cbe0c8c451bb47db2d652d7180c
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains numerous embedded links, including a redirector to a malicious URL, and a large number of links to other PDFs hosted on various domains. This indicates a link farm or redirection strategy to distribute malicious content. The ML classifier also strongly flagged this PDF as malicious. No scripts were extracted, but the primary attack vector appears to be the embedded URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wb?keyword=point%20line%20and%20plane%20postulates%20worksheet
    • http://sijukiliv.baanphitaktaweep.com/uploads/1/3/1/3/131378960/vupixaredumusojo.pdf
    • http://kojolelur.perfectpelvicfloor.com/uploads/1/3/1/4/131438164/8787555.pdf
    • http://files.riverrunranch.net/uploads/1/3/1/3/131379219/7367903.pdf
    • http://debiv.feel-flamenco.com/uploads/1/3/0/7/130775918/gikebo-mokad.pdf
    • http://jajojif.dianekrys.com/uploads/1/3/0/8/130813604/6696628.pdf
    • http://bibiku.cpsschoolcounselors.com/uploads/1/3/0/9/130969461/7822501.pdf
    • http://files.icater2youtravel.com/uploads/1/3/0/7/130739986/saninaja_dikesudes.pdf
    • http://tokitumuk.economicprojects.com/uploads/1/3/1/4/131483245/8741715.pdf
    • http://files.sudaneseamericanyouthcenter.org/uploads/1/3/1/0/131070113/c0c2a8b6ebdd.pdf
    • http://lodisimu.markyspartyrentals.com/uploads/1/3/0/8/130814469/2206703.pdf
    • http://xaledajid.emmakayonline.com/uploads/1/3/0/7/130740558/bivemusodukuvabexo.pdf
    • https://cdn.shopify.com/s/files/1/0429/9731/7783/files/vidizumox.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/tolipokegegami.pdf
    • https://cdn.shopify.com/s/files/1/0437/7228/0981/files/zoology_bsc.pdf
    • https://cdn.shopify.com/s/files/1/0437/7932/6103/files/36162923677.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005a3c.bin
7569a971e7626b06edfa10c6688684e30b85869d9ad3d0d02710fdfd8e62cc2b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5A3C 5088 bytes
font_01_sfnt_off00006b81.bin
cc23d36a5d7a3a98bf7b5974d7460804410ee6a60c54db5056288491a2b8a137		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6B81 9784 bytes
font_02_sfnt_off00008cfe.bin
05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8CFE 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.