Malicious PDF — malware analysis report

Static analysis result for SHA-256 9f1a5c1e17fe34aa…

MALICIOUS

PDF

35.4 KB Created: 2020-08-29 23:23:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: df5d4753f8e37c2cbf10f64702ee8b27 SHA-1: 9f0506d6fcc997a35c9bc52b39f4210f2a952759 SHA-256: 9f1a5c1e17fe34aa1268d13547a8d62ffa1c335297099436b47c725c12d22afd
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a link farm designed to redirect users to malicious infrastructure, specifically identified by the 'PDF_MALICIOUS_REDIRECTOR_LINK' heuristic. The document body, though heavily obfuscated, contains the malicious URL. The ML classifier also strongly indicated maliciousness. The primary attack vector appears to be luring users to a malicious site via a deceptive link.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=super+cheap+gold+coast
    • https://static.usrfiles.com/ugd/b8c837_a207f8817be44831a1eba6f3479d8ed8.pdf
    • https://static.usrfiles.com/ugd/b8c837_2ae2582386cf4e27979301d401409196.pdf
    • https://static.usrfiles.com/ugd/b8c837_ae06218149b2448b9d8164d7cf604aa0.pdf
    • https://cdn.shopify.com/s/files/1/0437/8594/5246/files/business_level_strategy_journal.pdf
    • https://cdn.shopify.com/s/files/1/0432/4917/2643/files/cutting_edge_advanced_workbook_answer_key.pdf
    • https://cdn.shopify.com/s/files/1/0433/0248/6180/files/wakegedubazizo.pdf
    • https://cdn.shopify.com/s/files/1/0438/4620/5602/files/gulefuridavovuwe.pdf
    • https://cdn.shopify.com/s/files/1/0433/9453/1493/files/set_path_linux.pdf
    • https://static.usrfiles.com/ugd/b8c837_f3f4a0e144e5436d86d7252bc50e2254.pdf
    • https://static.usrfiles.com/ugd/10a4aa_1525afb253f5454b9b0faebfc334b685.pdf
    • https://static.usrfiles.com/ugd/0a593f_70346181fe8f49659e28193483e9fb6d.pdf
    • https://static.usrfiles.com/ugd/b8c837_d698581ab6b34881bb95e69b237368cf.pdf
    • https://static.usrfiles.com/ugd/76156b_e5fe947f4e584d6a84ace928387f2aec.pdf
    • https://static.usrfiles.com/ugd/0779a3_89e7f299093a4aa6ad96f7a43e21bf30.pdf
    • https://static.usrfiles.com/ugd/3649d2_a827e63c20f2443a900ae318ecf92990.pdf
    • https://static.usrfiles.com/ugd/804ff6_dc8212f04d32443c84fd772bafc56eaa.pdf
    • https://static.usrfiles.com/ugd/b8c837_33e1cc63d4504eafa87113d5abcd29bb.pdf
    • https://static.usrfiles.com/ugd/0511f5_6b639b34e14c49da86d948ea3f26f28d.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004ccb.bin
4adbc2095af2e092ffd68c578d0786b1cd32216349331e419d3c7ae42c29d89d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4CCB 5436 bytes
font_01_sfnt_off00005f3c.bin
bc3284ee7141f58026faf5efc4f9db56de96946f830e55f3d13e6fe294b84d2d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5F3C 10096 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.