Malicious PDF — malware analysis report

Static analysis result for SHA-256 9854f2ccd9719c0d…

MALICIOUS

PDF

52.2 KB Created: 2020-09-05 18:52:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: b851cbbb21803a9217ce0d2c4c039e48 SHA-1: 19b82b0b6b6924553ddc37a19bc1ba68a26062fb SHA-256: 9854f2ccd9719c0d6f6c4de62917d5e47bd25640d416b019611e185ff041010f
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document was flagged as malicious by an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm and routes users through malicious redirector infrastructure. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/wix?keyword=angry+bird+movie+tamil+hd+free In PDF document text
    • http://bit.do/Hd-movies-2019In PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://cdn.shopify.com/s/files/1/0440/8436/3416/files/cannibal_ferox_free.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0431/7449/4369/files/92559636041.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0434/7055/3238/files/gold_star_chili_menu.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0450/2516/5470/files/chauhan_logo_photo.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0431/0571/4338/files/rapuvonasizipiza.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0430/7494/5184/files/74547153010.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/4725f1_d16e695051094849a05d35b6eee4af7d.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/b7082a_c64c59e4bd9f422e948b1a31414bcf4b.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/f3cb45_1670e3ecbc094c9d92427985cd14c4ea.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0460/8848/7076/files/kipiralun.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0431/6273/0645/files/kivaweruwagowepodibatuso.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0434/3978/4103/files/rusikikazusel.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006345.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6345 2952 bytes
SHA-256: d8b907802410e675ceca2784509e58a9dae2947c1b2ad43e3e0c02687eabed47
font_01_sfnt_off00006dd3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6DD3 5432 bytes
SHA-256: 0a4f8c0024ef022135f01a2444177d039ccc2d778a767d6542f25ea7b98b4d4c
font_02_sfnt_off00008032.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8032 13480 bytes
SHA-256: 790e72915e2b29e6c0023b9a2332796134e264e9da317dbfecb3b0442a4ff47b
font_03_sfnt_off0000ab7d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xAB7D 16392 bytes
SHA-256: 429c6b3ecd2920d64fba875f63fe68b34076b74bc67ac688e3f593d1a283ab81

Open this report in the interactive analyzer, or submit your own file for analysis.