Malicious PDF — malware analysis report

Static analysis result for SHA-256 7d0000d65b518ea2…

MALICIOUS

PDF

43.9 KB Created: 2020-08-07 06:55:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9ebc77db2d440a16bc49d369e52c828f SHA-1: 86a0b2846da0e9791d75fc6b1d9c0b490b90be6f SHA-256: 7d0000d65b518ea201ea4b5fd59aafe8818909a9233420c814209bac105a3814
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a large number of embedded links, with one specifically pointing to known malicious redirector infrastructure. The ML classifier also strongly indicated maliciousness. This suggests the document is designed to lure users to malicious sites, likely for phishing or to download further malware. No scripts were extracted, and the document body was heavily obfuscated.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=hygroma+colli+pdf
    • http://files.fusiliersheep.ca/uploads/1/3/1/4/131453990/sevarasekaz.pdf
    • http://files.kittykendall.com/uploads/1/3/1/6/131637679/gedipiputijigode.pdf
    • http://files.lessonsworthlearning.org/uploads/1/3/0/7/130740202/b2bf0f1ee8bba57.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://cdn.shopify.com/s/files/1/0427/9389/4044/files/sokegirezuvijere.pdf
    • https://cdn.shopify.com/s/files/1/0439/6518/6206/files/9336773716.pdf
    • https://cdn.shopify.com/s/files/1/0431/4054/6714/files/275640124.pdf
    • https://cdn.shopify.com/s/files/1/0435/4555/9189/files/britney_spears_criminal_russian_cover_mp3.pdf
    • https://cdn.shopify.com/s/files/1/0445/7195/1268/files/introduction_to_molecular_biophysics.pdf
    • https://cdn.shopify.com/s/files/1/0429/2630/9535/files/dilafuzixisazusaxagaxol.pdf
    • https://cdn.shopify.com/s/files/1/0430/8946/1410/files/noron.pdf
    • https://cdn.shopify.com/s/files/1/0429/1795/3702/files/76866023430.pdf
    • https://cdn.shopify.com/s/files/1/0431/8245/7000/files/84675366597.pdf
    • https://cdn.shopify.com/s/files/1/0434/3142/8248/files/surgical_anatomy_of_larynx.pdf
    • https://cdn.shopify.com/s/files/1/0440/3786/5637/files/36770252298.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000061ba.bin
4b3deefb1a0595808ad98fe0a1e378fdf7dbd2fb38931b4159e2472ed936c008		 pdf-font-stream PDF embedded font (sfnt) at offset 0x61BA 4844 bytes
font_01_sfnt_off0000722a.bin
7781c52d21100cde7a321d0d0248285edc3fb3431aef8d639d419f3d4ea3da26		 pdf-font-stream PDF embedded font (sfnt) at offset 0x722A 10292 bytes
font_02_sfnt_off0000950c.bin
d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378		 pdf-font-stream PDF embedded font (sfnt) at offset 0x950C 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.