Malicious PDF — malware analysis report

Static analysis result for SHA-256 838eb58150588812…

MALICIOUS

PDF

45.2 KB Created: 2020-08-19 06:04:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9763b2e19330725d1d04576fe96c5531 SHA-1: 4e9fef8a36a00d3b694e19455dfbea37cfb4dc20 SHA-256: 838eb581505888123a25b060f364cee23e2c16869b1f084f9faf0cad405344e1
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a significant number of embedded links, many of which point to external PDF files, indicating a link farm or redirector strategy. One critical heuristic identified a link to known malicious redirector infrastructure at 'https://ttraff.ru/pify?keyword=iatrics+visual+flow+sheet'. The ML classifier also strongly flagged this PDF as malicious. The document body is heavily obfuscated and contains what appears to be a URL, but the primary malicious activity is the mass linking.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=iatrics+visual+flow+sheet
    • http://files.lifeconnectioncenter.org/uploads/1/3/0/8/130814783/f33b09b0061fb4f.pdf
    • http://files.heymarcomusic.com/uploads/1/3/0/8/130874474/siwoviku_lupumusaxemu.pdf
    • http://wajipo.americanuktaxsolutions.com/uploads/1/3/0/9/130969198/c9f2ef9.pdf
    • http://files.urgentiegeneeskunde.com/uploads/1/3/0/9/130969426/6431847.pdf
    • http://files.sankofaoutreach.org/uploads/1/3/1/8/131856539/5906052.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0430/8343/2096/files/vyper_2._0_manual.pdf
    • https://cdn.shopify.com/s/files/1/0430/6108/4314/files/72886512658.pdf
    • https://cdn.shopify.com/s/files/1/0449/4888/1567/files/basic_interview_questions_for_ece_students.pdf
    • https://cdn.shopify.com/s/files/1/0437/5589/6983/files/xosusodilinetexeperikebu.pdf
    • https://cdn.shopify.com/s/files/1/0433/2827/4582/files/95698364563.pdf
    • https://cdn.shopify.com/s/files/1/0428/1348/9318/files/buccal_smear_examination_pdf.pdf
    • https://cdn.shopify.com/s/files/1/0430/0449/3987/files/vepugomipaxixipeziji.pdf
    • https://cdn.shopify.com/s/files/1/0435/2750/4024/files/export_to_word_adobe.pdf
    • https://cdn.shopify.com/s/files/1/0431/0705/7825/files/plural_form_of_irregular_nouns_worksheets.pdf
    • https://cdn.shopify.com/s/files/1/0432/0896/6307/files/nudibamanajepidanagez.pdf
    • https://cdn.shopify.com/s/files/1/0436/2744/6435/files/story_from_north_america.pdf
    • https://cdn.shopify.com/s/files/1/0433/1234/9334/files/79614176299.pdf
    • https://cdn.shopify.com/s/files/1/0431/0129/0650/files/leluketipolakabitiraf.pdf
    • https://cdn.shopify.com/s/files/1/0440/0388/5206/files/xonusenugigiwawijekima.pdf
    • https://cdn.shopify.com/s/files/1/0437/3463/0554/files/49821658557.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000072ce.bin
e59c905db1e7df9f2bc642030754edf5e80bc5c96a1699887ec335c1a41282f9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x72CE 5056 bytes
font_01_sfnt_off0000840e.bin
acdcc73893ac86f3efe78efe7aaba168ad3dbbdf1b8e67ec982ff0d1cf1f288f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x840E 10440 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.