Malicious PDF — malware analysis report

Static analysis result for SHA-256 814e7749a44dcbb2…

MALICIOUS

PDF

62.1 KB Created: 2020-08-12 00:43:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: eefecf399ab8a4b654b1ef765aed7eb6 SHA-1: 550146206ce3fb1c4a39e2a3bc92382243b0f10a SHA-256: 814e7749a44dcbb2170b51f3315515f0f067c143992991bb18408bcac4c78f10
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded links, with one identified as a malicious redirector. The ML classifier strongly flagged this PDF as malicious, and the presence of a link farm suggests an attempt to manipulate search engine results or lure users to malicious sites. No scripts were extracted, but the PDF structure itself facilitates the attack.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=neutron+cross+section+pdf
    • http://vegefa.buildnobleinc.com/uploads/1/3/1/0/131069934/8956441.pdf
    • http://files.coolnativesnursery.com/uploads/1/3/0/8/130874518/f9a7c.pdf
    • http://xalawitu.heathercoleman.co.uk/uploads/1/3/2/7/132712615/0103c9d9c743a.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0427/4746/1788/files/golelofufezotefo.pdf
    • https://cdn.shopify.com/s/files/1/0428/6418/1404/files/66339297264.pdf
    • https://cdn.shopify.com/s/files/1/0428/2076/3804/files/pv_narasimha_rao_books.pdf
    • https://cdn.shopify.com/s/files/1/0435/8235/7663/files/thomas_calculus_early_transcendentals_12th_edition.pdf
    • https://cdn.shopify.com/s/files/1/0433/6313/9733/files/clementine_spotify_plugin.pdf
    • https://cdn.shopify.com/s/files/1/0433/8706/0375/files/sajizumobubuwab.pdf
    • https://cdn.shopify.com/s/files/1/0429/3158/5180/files/wupaxaf.pdf
    • https://cdn.shopify.com/s/files/1/0437/8597/8013/files/neumonia_definicion.pdf
    • https://cdn.shopify.com/s/files/1/0431/5817/5893/files/164463138.pdf
    • https://cdn.shopify.com/s/files/1/0437/8125/9421/files/dowamiwojujuta.pdf
    • https://cdn.shopify.com/s/files/1/0430/8438/2357/files/92345259088.pdf
    • https://cdn.shopify.com/s/files/1/0440/1732/0094/files/qubool_hai_episodes.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00009861.bin
48018eac7d2735881ccc5b4c2f5de713e2f3e44744c10d3d25dade9e5cef98c9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9861 4876 bytes
font_01_sfnt_off0000a914.bin
50ef367d077cc85c80ca8348d1bc4d56a5321592ecd638cd3b9b6e61081d5d34		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA914 13900 bytes
font_02_sfnt_off0000d5f4.bin
f7c959ef3840947929b2fbf21a6f844c3d2ba9157ff04f9c13ff486e75cc34e4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD5F4 16192 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.