Malicious PDF — malware analysis report

Static analysis result for SHA-256 91c33c7e880b0261…

MALICIOUS

PDF

42.5 KB Created: 2020-09-09 22:49:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c755b679bc685f1d8199290bbfeb675f SHA-1: 762a5895ecd00f8185237a9d9d2f9fe4a9f61c7f SHA-256: 91c33c7e880b0261449ab181a1f1d5ba42b1e8011b3205e927fc199cd03c77a3
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document uses a movie title as a lure, which is a common social engineering tactic. It contains a significant number of embedded links, with the primary heuristic identifying a link to a known malicious redirector. The ML classifier also strongly indicated maliciousness. The presence of numerous external PDF links suggests a link farm or SEO poisoning attempt, potentially leading users to malicious sites or further malware downloads.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=aalavandhan+full+movie+free
    • http://fugolu.backtothecityfestival.com/uploads/1/3/2/8/132814930/badan_kerafisig_xunujed_jixuxevefo.pdf
    • http://semoboli.ecaplumbing.com/uploads/1/3/2/7/132740900/99dfb7c87e7f026.pdf
    • http://wolebenak.schoollibraryoutloud.org/uploads/1/3/2/3/132302780/zuzome.pdf
    • http://files.musicalcolts.com/uploads/1/3/0/7/130776607/1175993.pdf
    • http://files.ell-lady.com/uploads/1/3/0/7/130739895/roxesifoxoxede-bajikipoz-xakeroxofev-mitevokilavepo.pdf
    • https://static.usrfiles.com/ugd/b8c837_1272f4950e444fbfa716bbce6ea31bf6.pdf
    • https://static.usrfiles.com/ugd/5d2cf3_04abfcfc12044b829cac206eccb215f6.pdf
    • https://static.usrfiles.com/ugd/f967ac_8876eafced3d44fc92301b9be50f1c62.pdf
    • https://static.usrfiles.com/ugd/a64c8c_0a8be725d43c41619891ee2e38136872.pdf
    • https://static.usrfiles.com/ugd/12dc78_1529f2bffc34487392255f8a01a71b6e.pdf
    • https://static.usrfiles.com/ugd/3ce946_5d47b029a14f4d55b125b6b967795dfe.pdf
    • https://static.usrfiles.com/ugd/135178_9b2c2d806b954dde895d7a1d8c51ae10.pdf
    • https://static.usrfiles.com/ugd/078c79_3c25ce73fe3242fb94e967d0d71eecc9.pdf
    • https://static.usrfiles.com/ugd/b8c837_15186ec41161480583a176251b50e5bb.pdf
    • https://static.usrfiles.com/ugd/e4d7df_7c29bdcfc1274c9d8da3c78f2a570284.pdf
    • https://static.usrfiles.com/ugd/120f26_34a2d6e43f3a41b7ae23fa91e23618f7.pdf
    • https://static.usrfiles.com/ugd/6d59ab_3007e8451d774ba4ba614fea0cb89e42.pdf
    • https://static.usrfiles.com/ugd/d1d005_f41838a68676405cbe6430517ee8b223.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006896.bin
1a3d63cb86f2a647504959a422ce940e6210e6e1a0fd89ce6d150293f746fd0c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6896 5020 bytes
font_01_sfnt_off00007984.bin
31dcc467757e29f4061a57ddc6debc800dabc48235c5ac3fba8d768d978c0ffd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7984 10632 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.