Malicious PDF — malware analysis report

Static analysis result for SHA-256 9bcc7347e163625b…

MALICIOUS

PDF

39.0 KB Created: 2020-09-22 10:29:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a461fc3a79b68d07806b9e6a6bdffa1d SHA-1: ed7f22a5dd7d440f72ffbd000a4a469ba4d87aff SHA-256: 9bcc7347e163625b7aa6e126f87cb3119da1b01a4eab7da980fa88891416a5f8
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a link farm and a redirector link, both pointing to external websites. The document body text, though heavily obfuscated, contains the phrase 'dallas county medical examiner public records' and the malicious URL, suggesting a lure to trick users into clicking on the links. The presence of numerous PDF links and a malicious redirector indicates a phishing or scam attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/wix?keyword=dallas+county+medical+examiner+public+records
    • http://files.lifestylecuisinemeals.com/uploads/1/3/1/4/131407635/afe564.pdf
    • http://files.fcbcweaverville.org/uploads/1/3/0/7/130740429/sofujana.pdf
    • http://files.restaurantlegacysolutions.com/uploads/1/3/2/6/132695556/sareviludidaj-tegefewopukob.pdf
    • http://dodini.guarddogsurveillance.com/uploads/1/3/1/6/131606349/e3893053.pdf
    • http://files.husonprojects.com/uploads/1/3/0/7/130775362/wolotof_jokuvala_setikido_tebofinobem.pdf
    • https://cdn.shopify.com/s/files/1/0429/0910/6335/files/cambridge_certificate_in_advanced_english_3_complete_book.pdf
    • https://cdn.shopify.com/s/files/1/0431/9484/3298/files/beregiromegakujos.pdf
    • https://cdn.shopify.com/s/files/1/0431/7567/4014/files/introduction_to_algorithms_3rd_edition_textbook_solutions.pdf
    • https://cdn.shopify.com/s/files/1/0429/0415/8375/files/lesowoxovagotipevidisej.pdf
    • https://98681e93-fe20-47fb-b128-95b59f956efd.filesusr.com/ugd/460efe_04a02369a32f4186a849bef9561e5502.pdf?index=true
    • https://b6b60a1b-283b-4274-adde-229d7539be6e.filesusr.com/ugd/948cea_399d67cbf41a441baf4d34c718aab826.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004aab.bin
2f53e974dddc5275aaff8369acc8a8dc0335fcf01b1d9bcbcb16b6b174154f86		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4AAB 5412 bytes
font_01_sfnt_off00005cf4.bin
821b771951174c8a6d8781f3eb96d726d66cd439fb41f83bd25be7924cf70440		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5CF4 10692 bytes
font_02_sfnt_off00008152.bin
05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8152 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.