Malicious PDF — malware analysis report

Static analysis result for SHA-256 7b16f0845712d9e0…

MALICIOUS

PDF

41.2 KB Created: 2020-08-31 12:42:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f93e77b985c5d1b637b71dc4035387d6 SHA-1: dcebe955709283ddc6dc0495a76ba723796b61ad SHA-256: 7b16f0845712d9e079868cf75a9bba52da29d7a29f1600ba1f1f84b90ad91cdc
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a link to a known malicious redirector infrastructure, disguised with keywords related to training material. The document also hosts a large number of external PDF links, suggesting a link farm or SEO manipulation tactic. The ML classifier strongly indicated maliciousness, supporting the conclusion that this PDF is designed to redirect users to harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=xactimate+28+training+workbook+pdf+free
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://static.usrfiles.com/ugd/b8c837_0a694811ad564bd38b965194c57d12a1.pdf
    • https://static.usrfiles.com/ugd/b8c837_a4ad87bbb5ac45b1b7a6d1efa8027d16.pdf
    • https://static.usrfiles.com/ugd/2ac701_a709bd6dfeb84192863ad6a7235b7a71.pdf
    • https://static.usrfiles.com/ugd/b11f6d_c2469eabdc76417d9dd41870a783c539.pdf
    • https://static.usrfiles.com/ugd/b8c837_1d29f84383674b1c9f043a0dd805f1cf.pdf
    • https://static.usrfiles.com/ugd/b8c837_2cd2368c0c364fc0b2f561985575212e.pdf
    • https://static.usrfiles.com/ugd/33a16d_c56440c34d1944f1904f1ff6a11b2295.pdf
    • https://static.usrfiles.com/ugd/a64c8c_66872059f8b94915bb2a454ffc3a8ade.pdf
    • https://static.usrfiles.com/ugd/a31856_0cdc2f3ef8d94e788f5a0f7ee9c1e86d.pdf
    • https://static.usrfiles.com/ugd/b8c837_2faf4f556295421a976799ad36909cbd.pdf
    • https://static.usrfiles.com/ugd/b8c837_e293be7e91af4216bf6af103e57f767e.pdf
    • https://static.usrfiles.com/ugd/b8c837_0d364dab46e24a209039d58dd30071b8.pdf
    • https://static.usrfiles.com/ugd/73cb9e_bc75d8cd165247fbb29e4a44df79fd53.pdf
    • https://static.usrfiles.com/ugd/576447_87acf43aa30b4c0688c33d26ebab8075.pdf
    • https://static.usrfiles.com/ugd/d7ba0f_07a673de1dd64b7899f2fa99791ad6ca.pdf
    • https://static.usrfiles.com/ugd/e2f197_2d83e348ab154d178da0bede5b85f0ac.pdf
    • https://static.usrfiles.com/ugd/ee9d3f_4f69c60978ef423eb7415b145bec6bdc.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005f4c.bin
757446b461898da883158a1820de5cc9902ece346d57cd371e75d5abc7034a1e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5F4C 5864 bytes
font_01_sfnt_off0000733f.bin
eb95a54ed94314dae8087d5d58f05f8bfefe089dc5d507e7c384f97bbaf3638a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x733F 10728 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.