Malicious PDF — malware analysis report

Static analysis result for SHA-256 8179662cf2c5ff9d…

MALICIOUS

PDF

78.4 KB Created: 2020-07-20 11:54:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ebbdbeb411933df188a2663bbfdf6520 SHA-1: 82bbc2d32385c5a4a6718ae35d33a297e9e0a546 SHA-256: 8179662cf2c5ff9d7e35185d52e4707c940adc89e732c20100fb596da79b0012
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains numerous embedded links, with one identified as a malicious redirector. The document body, though heavily obfuscated, suggests a lure related to 'scheming pdf'. The presence of a link farm and a critical heuristic firing for malicious redirector infrastructure strongly indicates an attempt to direct users to harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9898

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=definition+of+scheming+pdf
    • http://files.activesportssolutions.com/uploads/1/3/1/1/131164476/0b7cf9899.pdf
    • http://files.hannesmarais.com/uploads/1/3/0/7/130738915/8feb47bad20a624.pdf
    • http://files.aliveleadership.com/uploads/1/3/0/7/130775014/navajifog-wewizenolifi.pdf
    • http://files.wildthingyogaboutique.com/uploads/1/3/1/4/131406036/ef2677d7e52b41a.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fedorahosted.org/lohit
    • http://www.opentle.org
    • https://cdn.shopify.com/s/files/1/0429/4865/7311/files/55074753246.pdf
    • https://cdn.shopify.com/s/files/1/0433/6225/5013/files/77224524906.pdf
    • https://cdn.shopify.com/s/files/1/0430/6134/6466/files/velad.pdf
    • https://cdn.shopify.com/s/files/1/0433/4374/1083/files/28165292914.pdf
    • https://purupona.files.wordpress.com/2020/06/bigibenusifozusupeloj.pdf
    • https://dufamisiril.files.wordpress.com/2020/06/gapojezakuxigiwirobem.pdf
    • https://vabadepofi.files.wordpress.com/2020/06/57199754304.pdf
    • https://loxamog.files.wordpress.com/2020/06/deluvuwusifejodekesem.pdf
    • https://wekusov.files.wordpress.com/2020/06/ropuzegan.pdf
    • https://cdn.shopify.com/s/files/1/0428/1883/0492/files/12875207208.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/kenawuvotijogajutimev.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/84113106953.pdf
    • https://cdn.shopify.com/s/files/1/0428/8105/6935/files/81338683784.pdf
    • https://cdn.shopify.com/s/files/1/0432/9567/0432/files/88015572325.pdf
    • https://cdn.shopify.com/s/files/1/0430/2100/9053/files/8817516389.pdf
    • https://cdn.shopify.com/s/files/1/0431/7147/9709/files/21095121453.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/romiket.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://scripts.sil.org/OFL
    • http://www.gnu.org/licenses/gpl.html

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_013_off0000fefe.bin
9a53eb0f5d899206140142024e1329928d04523b9b037af6ea44b3d64dff0b7c		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xFEFE 18176 bytes
font_00_sfnt_off0000808b.bin
b044f7aea9bd4da09f60dbfa6c607eb09ad2994fa39cfb6d63ff774511ceb15f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x808B 5588 bytes
font_01_sfnt_off0000941a.bin
2bb2d20ade225035d82678ff9885cba96407a3d1c378183dc675a055b9d5231a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x941A 5020 bytes
font_02_sfnt_off0000a50f.bin
dbaab8dcf32bfe64cb008f34eb54f5316f62236e8dffe3de49b44225404383a5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA50F 2656 bytes
font_03_sfnt_off0000b013.bin
864cbe2c6973b44d2b71e19ffbffb2328dcb3759b07ceb43c11d5a372fc4956d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB013 2328 bytes
font_04_sfnt_off0000bac9.bin
d117309382da938f7dffedc42f90dd4217b4d540d75629b80669d975ecbc171e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xBAC9 2108 bytes
font_05_sfnt_off0000c494.bin
538512be6c526ea957b587fa229624d829dca4873b622d187784a60d2c877fcd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC494 6640 bytes
font_06_sfnt_off0000d632.bin
ace3cabc285a137ed64431194d190f54a436bbca23ad27fd0f6ed1096b4ee4ec		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD632 12304 bytes
font_08_sfnt_off00011bd1.bin
c12c670e310cd2dd0f4b1ea6ea0d01ef35e1284caa1cfc967b978b02bd897c09		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11BD1 3276 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.