Malicious PDF — malware analysis report

Static analysis result for SHA-256 8129730fd02141be…

MALICIOUS

PDF

41.9 KB Created: 2020-08-31 20:02:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 50e395f23ea48ddafebddcc148fa494c SHA-1: ebdf8f542974a1b390044b498e064e3825236cf2 SHA-256: 8129730fd02141be90383a6c7e1079d78eda215a6970d1b1dba54a61e7763563
162 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains embedded links that are part of a link farm, with one critical link pointing to a known malicious redirector. The document body, though heavily obfuscated, contains text related to a "Clash of Clans hack" and the malicious URL, suggesting a social engineering lure. The presence of numerous PDF links and a malicious redirector indicates an attempt to drive traffic to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=clash+of+clans+hack+version+2018
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0452/2963/7792/files/75494331057.pdf
    • https://cdn.shopify.com/s/files/1/0439/2720/8091/files/bcourses_berkeley_edu.pdf
    • https://cdn.shopify.com/s/files/1/0432/5824/9376/files/11471581181.pdf
    • https://cdn.shopify.com/s/files/1/0434/6563/8048/files/renej.pdf
    • https://cdn.shopify.com/s/files/1/0432/8947/7278/files/15472399138.pdf
    • https://static.usrfiles.com/ugd/1e32c2_e187e095fbae49428c26848cc1f1b629.pdf
    • https://static.usrfiles.com/ugd/b8c837_0d2c8329fb094d4db01d7011dc740726.pdf
    • https://static.usrfiles.com/ugd/271e65_4d2bfe4ce1d84e279b00695a52f24294.pdf
    • https://static.usrfiles.com/ugd/6f7357_479532ee6798493fb3bbe72d822493b8.pdf
    • https://static.usrfiles.com/ugd/d1c05f_c31dd16341da4c0b8853ca4ce4f6f53e.pdf
    • https://static.usrfiles.com/ugd/63022f_f2e8d68b91434fe08d15ae76755f18c0.pdf
    • https://static.usrfiles.com/ugd/f4de5e_4adf6aa241c7448b948960adee026cd6.pdf
    • https://static.usrfiles.com/ugd/0511f5_bb39d7395c954f8eb9a5d9f204082b43.pdf
    • https://static.usrfiles.com/ugd/b8c837_bb0b269674d1435fa64e45e31a845c02.pdf
    • https://static.usrfiles.com/ugd/ad2ade_c1b16750a10d44b79b4b4e40544e9cc8.pdf
    • https://static.usrfiles.com/ugd/b8c837_c2fb51372f29401490b51c546366477a.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000652a.bin
d5d3ebb30294dc1c3863110309cf5fbe671837f56b777f9b602f42819a4c3016		 pdf-font-stream PDF embedded font (sfnt) at offset 0x652A 5520 bytes
font_01_sfnt_off000077ed.bin
16b54b24d124bcd4f72f8047522caac93a2e1db7a3edf0b1e10dcb206290eea6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x77ED 10264 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.