Malicious PDF — malware analysis report

Static analysis result for SHA-256 a21d42976ea36a56…

MALICIOUS

PDF

51.3 KB Created: 2020-08-12 19:33:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: dd93dedb6fbce576917d020f1c875d97 SHA-1: 6b82af981883c3670765cf4dbd1dce2277d1cfdb SHA-256: a21d42976ea36a564ea7b6a0ed71d1bcbe4a6c6b6ccefd936f46954a0cbe49b2
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a mass external link farm, with many links pointing to Shopify domains hosting other PDFs, ultimately redirecting to a malicious URL. The document body, though heavily obfuscated, contains text related to 'Andhra university distance education notification 2019-20 pdf' and the malicious redirector URL, indicating a lure to trick users into visiting potentially harmful content. The ML classifier strongly supports the malicious nature of this PDF.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wb?keyword=andhra%20university%20distance%20education%20notification%202019-20%20pdf
    • http://files.seanaffordfineartstudio.co.uk/uploads/1/3/1/4/131438461/9233b5592b64.pdf
    • http://tafavuv.dogtrainingismypassion.com/uploads/1/3/0/7/130776031/rameb.pdf
    • http://files.nebulawebsolutions.com.au/uploads/1/3/2/6/132696249/dexuzijolopu.pdf
    • http://files.abcdswoh.org/uploads/1/3/1/0/131071067/4754929.pdf
    • http://toxavi.mintzathletics.com/uploads/1/3/2/8/132814930/a3af5b7a5af4cfb.pdf
    • http://files.nebulawebsolutions.com
    • https://cdn.shopify.com/s/files/1/0428/3393/6547/files/datutik.pdf
    • https://cdn.shopify.com/s/files/1/0434/6734/1981/files/66760697433.pdf
    • https://cdn.shopify.com/s/files/1/0432/8158/0188/files/xowopanivesebi.pdf
    • https://cdn.shopify.com/s/files/1/0428/5107/4214/files/mifojesob.pdf
    • https://cdn.shopify.com/s/files/1/0430/9116/5333/files/nelowujaboxoloworenaka.pdf
    • https://cdn.shopify.com/s/files/1/0433/8132/5987/files/27151895691.pdf
    • https://cdn.shopify.com/s/files/1/0437/6104/1569/files/gajivatakerikozuk.pdf
    • https://cdn.shopify.com/s/files/1/0430/2739/8807/files/pipoxukalu.pdf
    • https://cdn.shopify.com/s/files/1/0428/4622/4551/files/33295254330.pdf
    • https://cdn.shopify.com/s/files/1/0434/8638/0197/files/dugazelag.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006d6d.bin
97409c1494896a33291d4997e50024f8b7114183ad4afaa6b9c13b4732300361		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6D6D 5876 bytes
font_01_sfnt_off00008171.bin
652e807f5a3f661b4b7e392ef85d86386493b6ca9f24b2a244a871a4e3a37ff7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8171 4432 bytes
font_02_sfnt_off0000918f.bin
e6d9710b833700db7e427aba5a7dd510acc0dffe6b29346adee7e0c6e9d93de8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x918F 14688 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.