Malicious PDF — malware analysis report

Static analysis result for SHA-256 a4d1ce62a1c82ca4…

MALICIOUS

PDF

69.2 KB Created: 2020-08-13 20:32:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0a4756a10ba62710589333ecd3d4713c SHA-1: e3a47a8c0c5248fe1b8ff0f52fdd3642dbe5559c SHA-256: a4d1ce62a1c82ca4133db946618d5059d6d29432cc0ec20c178d99fa690df513
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links, with one critical heuristic firing indicating a link to known malicious redirector infrastructure. Another critical heuristic identifies this as a PDF link farm, suggesting an attempt to manipulate search engine results or lure users to malicious sites. The ML classifier strongly supports the malicious verdict. No scripts were extracted, and the document body is heavily obfuscated, but the presence of numerous links points to a delivery mechanism focused on external redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wb?keyword=what%20is%20equivalence%20in%20translation%20pdf
    • http://files.trailhack.net/uploads/1/3/1/4/131483275/3065398.pdf
    • http://xukatabe.brittneynicolefloristry.com/uploads/1/3/0/8/130813528/31a76f5e84.pdf
    • http://files.shootitrawphotography.com/uploads/1/3/0/9/130969652/9035476.pdf
    • http://files.coljonesswimhurstville.com.au/uploads/1/3/2/7/132741181/9628755.pdf
    • https://cdn.shopify.com/s/files/1/0429/5586/6263/files/kuzibusogupokozugowu.pdf
    • https://cdn.shopify.com/s/files/1/0434/3539/3180/files/jexoruvutol.pdf
    • https://cdn.shopify.com/s/files/1/0436/9140/9561/files/super_smash_bros_brawl_unlockable_characters.pdf
    • https://cdn.shopify.com/s/files/1/0435/5204/7263/files/91006559476.pdf
    • https://cdn.shopify.com/s/files/1/0438/1189/7504/files/zorifudidubedafogole.pdf
    • https://cdn.shopify.com/s/files/1/0431/3192/8730/files/70411908878.pdf
    • https://cdn.shopify.com/s/files/1/0429/7588/7523/files/ziwazanepobufonawu.pdf
    • https://cdn.shopify.com/s/files/1/0433/5491/4981/files/wilowoxofixika.pdf
    • https://cdn.shopify.com/s/files/1/0433/0536/9758/files/chris_kraus_aliens_and_anorexia.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_005_off0000d053.bin
bc311c62b8735e5bf6dbaff95c7bf4320d625ac804508827ee3493897e6468de		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xD053 23832 bytes
font_00_sfnt_off0000982e.bin
2cbf72e962b4379f29c6206a69bc4b4b9054d66ba3e0e07c5c4c8fa8cfc1caa2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x982E 5324 bytes
font_01_sfnt_off0000aa43.bin
dc284cd06c52c5cf5b27262a02a2dcf528408843152bee5b1bd39f8b7bbdca0a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAA43 11332 bytes
font_03_sfnt_off0000f94f.bin
781b9fae2fb9201b4a05d2041fea553bb2973f1d011ab9c51e3326c72e342c60		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF94F 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.