Malicious PDF — malware analysis report

Static analysis result for SHA-256 82cd84190615c44d…

MALICIOUS

PDF

65.3 KB Created: 2020-07-31 00:15:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3e2c5d51f7b44883158e52b7aab9983b SHA-1: e069e17bdeb39e0e3eeb1e59a1483c749bdff83f SHA-256: 82cd84190615c44de02d20b00e6c76f94f72a439206ec964a85f4fcbf90cec50
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link that redirects to a known malicious domain, likely as part of a phishing or scam campaign. The embedded content and heuristics strongly indicate a malicious redirector designed to lead users to harmful sites, possibly for further exploitation or credential harvesting. No scripts were extracted, but the PDF structure and link analysis are sufficient for this assessment.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=pdf+editor+edit+pdf+adobe+acrobat+x+pro+free+download
    • http://files.veniceisthinking.com/uploads/1/3/0/7/130775350/ed53c53bef80994.pdf
    • http://files.hertruthinwords.com/uploads/1/3/1/3/131379578/6878728.pdf
    • http://files.thebridgechurchmt.org/uploads/1/3/0/8/130814065/kedewiwobed-zovej.pdf
    • http://files.easyaspitutoring.net/uploads/1/3/2/3/132302780/dibofozapov_vuxesosoxuvixe.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0435/3484/4059/files/72843457857.pdf
    • https://cdn.shopify.com/s/files/1/0434/7274/8710/files/23775835762.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/tepumesuz.pdf
    • https://cdn.shopify.com/s/files/1/0437/1054/6074/files/tixugekuvomuwijevexilopo.pdf
    • https://cdn.shopify.com/s/files/1/0429/6422/2101/files/15640349658.pdf
    • https://cdn.shopify.com/s/files/1/0433/0710/6462/files/78157051867.pdf
    • https://cdn.shopify.com/s/files/1/0432/7338/8190/files/rajanugaziveniko.pdf
    • https://cdn.shopify.com/s/files/1/0433/3309/1480/files/mavamavekopadoxabupusaje.pdf
    • https://cdn.shopify.com/s/files/1/0430/3310/0439/files/verakamulojanoj.pdf
    • https://cdn.shopify.com/s/files/1/0431/4726/4166/files/98992559561.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000096a3.bin
5d76b9f44c5bea5b7d7e65ac1742eb1eef2d0a0bedea1f2c6afd430590136af0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x96A3 5236 bytes
font_01_sfnt_off0000a90e.bin
842d5258acc25b0e4ff2c9ef28810b06c4577a81d93c2a3cca3aaad618970541		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA90E 5060 bytes
font_02_sfnt_off0000ba5a.bin
4a40577c7efe490dafe1fb941e71c52a9b97e4916dfd5eac1e6b002482c782d9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xBA5A 11376 bytes
font_03_sfnt_off0000dfc1.bin
6a519f54f5516a02950eed31c222a33217e1daf964577f37e3b402c146ae77cd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDFC1 16488 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.