Malicious PDF — malware analysis report

Static analysis result for SHA-256 7dcec4eff4334938…

MALICIOUS

PDF

40.5 KB Created: 2020-07-28 20:04:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c65ba1028c99fb1c77bdbb869f98441d SHA-1: 5b311412416dd0873a83136c9f876949d78ca905 SHA-256: 7dcec4eff4334938dff45b8b3a724abd419e74c96dc1889cf8d8a4c946e80cec
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF was flagged by multiple critical heuristics for containing malicious redirector links and a large number of embedded links, suggesting a link farm. The ML classifier also strongly indicated maliciousness. The document body, though heavily obfuscated, contains text related to 'business card template' which could be a lure. The primary IOC is the malicious redirector URL, which is likely the first step in a multi-stage attack.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=business+card+template+nz+free
    • http://files.meiraacademy.org/uploads/1/3/2/7/132740343/fivarutabosunitamas.pdf
    • http://files.lifewisegifts.com/uploads/1/3/0/8/130813781/dupijixu_jaxamuveruzi_gomikepe.pdf
    • http://files.texasshowcasecircuit.com/uploads/1/3/2/7/132741194/riwirif-nepuwe.pdf
    • http://files.churchofsaintmarks.org/uploads/1/3/2/3/132303320/ab3242e8aa1a4.pdf
    • http://files.pgjdesigns.com/uploads/1/3/0/7/130739776/ditunim-vezode-vadaketuj.pdf
    • http://files.meiraacademy.org/uploads/1/3/2/7/132740343/fivarutabosunitamas
    • https://cdn.shopify.com/s/files/1/0432/4406/0839/files/vomixijunosiv.pdf
    • https://cdn.shopify.com/s/files/1/0432/0264/2075/files/zabakarorakoragekebaxer.pdf
    • https://cdn.shopify.com/s/files/1/0428/0611/6511/files/83959272393.pdf
    • https://cdn.shopify.com/s/files/1/0430/8946/1410/files/vepufune.pdf
    • https://cdn.shopify.com/s/files/1/0441/4291/9832/files/90114138628.pdf
    • https://cdn.shopify.com/s/files/1/0431/6502/4416/files/wepavobap.pdf
    • https://cdn.shopify.com/s/files/1/0428/6336/2204/files/26819818438.pdf
    • https://cdn.shopify.com/s/files/1/0430/0334/7097/files/vikixubikojisuvokakujuxok.pdf
    • https://cdn.shopify.com/s/files/1/0440/7181/3285/files/fapogusibol.pdf
    • https://cdn.shopify.com/s/files/1/0436/0775/2861/files/5081953503.pdf
    • https://cdn.shopify.com/s/files/1/0427/8901/1612/files/nuwiz.pdf
    • https://cdn.shopify.com/s/files/1/0431/7108/6492/files/saxinameda.pdf
    • https://cdn.shopify.com/s/files/1/0428/2476/1507/files/51266433034.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000605f.bin
a3e20f0f26b1252f086fe68668996651d57b74cf2a1f631a397d31705773aba6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x605F 5172 bytes
font_01_sfnt_off000071d9.bin
d89943dce01a4b7344a818fc9190a25beeab2620095c4edfd07c7fea6fbd401c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x71D9 10248 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.