Malicious PDF — malware analysis report

Static analysis result for SHA-256 98aa108f1704253e…

MALICIOUS

PDF

40.1 KB Created: 2020-08-23 06:58:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9bd99ee715f00a21d2d8e778968735d3 SHA-1: a1ec23eb7a89ee414148c157ab854186065905b9 SHA-256: 98aa108f1704253e379ca15fc834e5641d261d91b60d8f20b9e053ffd21ae00e
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a significant number of embedded links, with the primary URL pointing to a redirector service. This suggests a phishing or malicious content delivery attempt, where the redirector is used to obscure the true destination. The ML classifier also strongly indicated maliciousness. No scripts were extracted, limiting the ability to determine specific payload delivery mechanisms.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=cghs+online+form+submission
    • http://reluwap.hatfieldchurch.org/uploads/1/3/0/7/130776031/lurubutudodefure.pdf
    • http://nikoduju.rcfenceanddecks.ca/uploads/1/3/2/6/132681352/dusub-saduxi-letakapekob-jeberufesonu.pdf
    • http://files.emilyrobynclark.com/uploads/1/3/0/9/130969762/18a4d2005e.pdf
    • http://files.senecahistory.com/uploads/1/3/1/3/131381602/jukosunowukezej.pdf
    • http://bufekazi.adviceandexperiencescheme.com/uploads/1/3/1/4/131453858/c0fabf5e352d7.pdf
    • https://cdn.shopify.com/s/files/1/0432/7168/4252/files/71216413101.pdf
    • https://cdn.shopify.com/s/files/1/0428/8184/3356/files/sagifenanevunowimedize.pdf
    • https://cdn.shopify.com/s/files/1/0433/9394/1671/files/56452444996.pdf
    • https://cdn.shopify.com/s/files/1/0429/9449/9743/files/vetukofenorisegalupilamar.pdf
    • https://cdn.shopify.com/s/files/1/0430/3935/9127/files/fafunewekuvupoxos.pdf
    • https://cdn.shopify.com/s/files/1/0435/1698/5503/files/manosuwexepikagomexibo.pdf
    • https://cdn.shopify.com/s/files/1/0427/9320/5916/files/3651012801.pdf
    • https://cdn.shopify.com/s/files/1/0431/1734/6965/files/9658050407.pdf
    • https://cdn.shopify.com/s/files/1/0436/2623/4009/files/bnficiaire_effectif.pdf
    • https://cdn.shopify.com/s/files/1/0435/3140/3423/files/captivated_by_you_sylvia_day_free_download.pdf
    • https://cdn.shopify.com/s/files/1/0428/2508/9191/files/mumitofebalajom.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000060a5.bin
6fef209f056bdc566e0f7f7cbe825ef06345c8098f45088e2960772fa9b985c1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x60A5 5016 bytes
font_01_sfnt_off00007187.bin
fba5be6ce35180b802d255d212eec62d5cc5a9e8d7f0a353f3e50f136f5d8209		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7187 10004 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.