Malicious PDF — malware analysis report

Static analysis result for SHA-256 911f69fc36c916ee…

MALICIOUS

PDF

93.5 KB Created: 2020-08-08 13:38:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a1400ccd3fd88dbe382f4860344db638 SHA-1: e5514ca27040b16e6aaed2ec0b5b5bb1befb81c9 SHA-256: 911f69fc36c916eec330de412cfcb84b9282b2f793c206789aa1637088c6da14
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by multiple critical heuristics for containing a malicious redirector link and a large number of external links, suggesting a link farm or phishing lure. The ML classifier also strongly indicated maliciousness. The primary malicious IOC is the redirector URL, which is likely used to funnel victims to further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=adjoint+functors+pdf
    • http://files.bellacalore.com/uploads/1/3/0/8/130814279/mumubimogamu-fupedevumebat-ropetiwajo.pdf
    • http://files.sheningtongreen.com/uploads/1/3/1/6/131637477/devoboneluxijozug.pdf
    • http://files.nerangpublications.com/uploads/1/3/0/7/130776602/dd4f4a6ae5af398.pdf
    • http://files.awarenessties.us/uploads/1/3/1/6/131606016/2878725.pdf
    • http://files.scsaintstrack.com/uploads/1/3/1/8/131871535/c265427953ca75.pdf
    • https://cdn.shopify.com/s/files/1/0430/3319/8745/files/kirchhoff_s_second_law.pdf
    • https://cdn.shopify.com/s/files/1/0427/4959/1718/files/maloruzus.pdf
    • https://cdn.shopify.com/s/files/1/0430/0151/2090/files/pesedipe.pdf
    • https://cdn.shopify.com/s/files/1/0430/5970/8058/files/16960391527.pdf
    • https://cdn.shopify.com/s/files/1/0432/8030/2240/files/jifuxenadus.pdf
    • https://cdn.shopify.com/s/files/1/0433/6448/3240/files/bitafovoreberapavazew.pdf
    • https://cdn.shopify.com/s/files/1/0434/5354/6656/files/diseases_caused_by_staphylococcus_aureus.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/dipipopiluniwewikojidil.pdf
    • https://cdn.shopify.com/s/files/1/0432/5372/7387/files/30281750815.pdf
    • https://cdn.shopify.com/s/files/1/0435/1302/0570/files/biostatistics_question_bank.pdf
    • https://cdn.shopify.com/s/files/1/0433/5999/4014/files/daniel_boorstin_the_creators.pdf
    • https://cdn.shopify.com/s/files/1/0430/8415/2986/files/10146774329.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001005d.bin
f1585241b59a1002e627af24859d8bddc2a41f5101ead6a7a290360bc82d6b36		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1005D 2912 bytes
font_01_sfnt_off00010ac2.bin
2285d7a3de1ea59a8f12f6c32919b22660b98215feb4b035f2840c8b41653eef		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10AC2 4972 bytes
font_02_sfnt_off00011bcc.bin
7be26bf77b43df5df6a1eaa65e349de2d3e32a5c8cdccfcd9cdbb78a0747a912		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11BCC 15772 bytes
font_03_sfnt_off00014e1f.bin
1173b2d967807186e453ec739c3d2a0832b05142fdf89dfa04b2d5082c60eb6d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14E1F 17332 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.