Malicious PDF — malware analysis report

Static analysis result for SHA-256 a58ea24d5ea920bb…

MALICIOUS

PDF

48.9 KB Created: 2020-09-23 03:09:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ad870c934314b3536296efc1a9bfc306 SHA-1: 0de68c424e07a629f94265290994037c29b23c25 SHA-256: a58ea24d5ea920bb4756eee57a8e3ba2061390bb32264f69ccb9a93c75386da7
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a mass of external links, including a primary link to a known malicious redirector. The document body, though partially corrupted, suggests a lure related to textbook answers, which is used to disguise the malicious intent. The primary malicious URL is https://ttraff.me/wix?keyword=beginning+and+intermediate+algebra+with+power+learning+4th+edition+answers.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=beginning+and+intermediate+algebra+with+power+learning+4th+edition+answers
    • http://files.artimc.org/uploads/1/3/1/6/131606094/notokago_tosavanu.pdf
    • http://files.carsagasfastlane.com/uploads/1/3/2/6/132682790/sivoriferejo_faxapeninavik_tevinopix.pdf
    • http://files.oxfordfamilyhypnotherapy.co.uk/uploads/1/3/1/6/131606027/dafuf-dotepob-fulasobuj-fadopugadi.pdf
    • http://faxujun.oberonmassage.com/uploads/1/3/2/6/132696147/4df983377f.pdf
    • http://files.plbra.org/uploads/1/3/2/7/132710779/poniresokipofade.pdf
    • https://42839dbb-a107-4a55-bb84-aeae961d864b.filesusr.com/ugd/b0c717_75d53dc8f90945379d645ad780625934.pdf?index=true
    • https://3221f09e-30d0-45dd-856a-f0ca991a7ff1.filesusr.com/ugd/9c0842_617d0df422bd41da87f09a71dca5e41a.pdf?index=true
    • https://b43f7793-9cd8-4c55-abbe-f8a63be8f8aa.filesusr.com/ugd/b916f4_dc04c016d5344fc5ae88083dde3fd689.pdf?index=true
    • https://2961c1ef-3813-4624-a183-ace7bb0ddf1f.filesusr.com/ugd/8ce377_7a5929dbe91546c6a8a086d79f1f2846.pdf?index=true
    • https://9da2955f-a94c-4b7e-af97-7cb60f6f1656.filesusr.com/ugd/418e76_d33b2888dffc484588fd1a0e1f21d13e.pdf?index=true
    • https://cdn.shopify.com/s/files/1/0434/1425/7815/files/fonodudik.pdf
    • https://cdn.shopify.com/s/files/1/0429/6825/2565/files/8116842111.pdf
    • https://cdn.shopify.com/s/files/1/0478/0838/1087/files/lemewixametatevotod.pdf
    • https://cdn.shopify.com/s/files/1/0434/7795/8822/files/how_to_report_corruption_cases_in_kenya.pdf
    • https://cdn.shopify.com/s/files/1/0437/7398/4919/files/jolene_uke_chords.pdf
    • https://cdn.shopify.com/s/files/1/0434/4869/6993/files/arabic_movies_free_full_version.pdf
    • https://cdn.shopify.com/s/files/1/0431/1236/6229/files/maxima.pdf
    • https://cdn.shopify.com/s/files/1/0428/1437/4047/files/hx_of_glioblastoma_multiforme_icd_10.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000071a4.bin
7101e9ad91b56057510ed2947f90abcec9738c4196ca7720792b6f9a59e16e29		 pdf-font-stream PDF embedded font (sfnt) at offset 0x71A4 3464 bytes
font_01_sfnt_off00007dfa.bin
97cfe1a26a734b39263561247b15b4d9aa43518829c670f252e55a4c613129bd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7DFA 5744 bytes
font_02_sfnt_off00009167.bin
f95d7b26c1bdf83f866ab40863bd39d68c71cc5d02f2de0cbfd6b89593d9f03b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9167 10500 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.