Malicious PDF — malware analysis report

Static analysis result for SHA-256 7d3b65cbb3455426…

MALICIOUS

PDF

39.3 KB Created: 2020-09-17 19:46:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d59aa824f64b92fc87350a81e59ebba0 SHA-1: 5c136f94dcf91d47d8ce93b8fa118fe9d2a44bde SHA-256: 7d3b65cbb34554263b17981f19fe102604a0dd409d9b135e916d907a36374915
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains numerous embedded links, with one identified as a malicious redirector. The document body, though heavily obfuscated, appears to contain the same URL as the malicious link, suggesting an attempt to trick users into clicking it. The presence of a link farm further indicates a malicious intent to distribute malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=unit+4+review+cellular+energy+worksheet+answers
    • http://files.tutshillpreschool.org/uploads/1/3/1/0/131071056/452130.pdf
    • http://rikeledav.diarysketches.com/uploads/1/3/2/7/132712109/kagikarib.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://aafb6cf7-3dc8-4dd0-87b1-12dac2518069.filesusr.com/ugd/c450b2_ee3f63da95e74751ae80b855e2ba72bb.pdf?index=true
    • https://84dbcac0-6473-4563-9db3-db3a1c5c49d3.filesusr.com/ugd/8e6e76_9083a64bece54f568d11154256cef340.pdf?index=true
    • https://79efc1db-54a5-479c-b269-c337ae0e349a.filesusr.com/ugd/a31856_553f0d4ba3144402b58188fee4558235.pdf?index=true
    • https://b5b83444-8cec-437e-8e0b-c6e10dab6743.filesusr.com/ugd/f08e01_bc6b79389e754df6a96ebd2411e6ba79.pdf?index=true
    • https://f02e3a86-775b-444b-aff9-8d25843daf48.filesusr.com/ugd/de60da_800f6474165a4d3e8de21a30b7de38bb.pdf?index=true
    • https://cdn.shopify.com/s/files/1/0466/9073/0148/files/factors_affecting_blood_coagulation.pdf
    • https://cdn.shopify.com/s/files/1/0431/6453/2887/files/pafagirowaj.pdf
    • https://cdn.shopify.com/s/files/1/0434/4968/0028/files/scan_barcode_android_sample.pdf
    • https://cdn.shopify.com/s/files/1/0429/2080/4518/files/hindi_serial_sony.pdf
    • https://cdn.shopify.com/s/files/1/0433/6628/5462/files/varuvuguwobumeruzuvovagaf.pdf
    • https://cdn.shopify.com/s/files/1/0429/7474/0636/files/zexuxilagokuvi.pdf
    • https://cdn.shopify.com/s/files/1/0437/6523/5866/files/bluetooth_lavalier_microphone_for_android.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000059bf.bin
21d91fb2fe1acc03dfba317b80ddc2bcd5109429836043cb12a03264eca07603		 pdf-font-stream PDF embedded font (sfnt) at offset 0x59BF 5460 bytes
font_01_sfnt_off00006c73.bin
9ab1fedd5f7cf82ef75ff211741ea80f1488b1bf9e20ba075ea0cdfc1aeac8c8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6C73 10516 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.