Malicious PDF — malware analysis report

Static analysis result for SHA-256 a89d01e3905c061b…

MALICIOUS

PDF

36.8 KB Created: 2020-09-18 06:12:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 069013ff55aa2011705ef450d98746aa SHA-1: 29225680880434dac86b7ef279d1be0d16100ca5 SHA-256: a89d01e3905c061bac66684212275186d691b2efc4561fa69f6bfb704b8225ba
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a mass of external links, with one prominent link pointing to a known malicious redirector. The document body, though heavily obfuscated, contains text that appears to be a song title and metadata, suggesting a lure to disguise the malicious intent. The presence of numerous PDF links, including one to a redirector, indicates a likely phishing or scam campaign aiming to lead users to malicious content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=reptilia+bass+cover
    • http://gibusupab.hedgequote.com/uploads/1/3/2/7/132710654/nejawotitutasu.pdf
    • http://fobagik.bebeckerlegartanddesign.co.uk/uploads/1/3/0/8/130874218/95384.pdf
    • http://migupizib.electricaloutlet.info/uploads/1/3/1/8/131859527/27a2470.pdf
    • http://files.tillersmath.com/uploads/1/3/0/9/130969434/75066b99189aec2.pdf
    • http://files.backyardhackers.com/uploads/1/3/1/6/131606533/2433553.pdf
    • https://7a38fc8f-5324-45ad-91b3-19f660c3bfe9.filesusr.com/ugd/c6ac46_4d06aafad79c4002a489f1b4205465e6.pdf?index=true
    • https://f6c20033-93e0-410f-bdc2-d0c29681c6ff.filesusr.com/ugd/a771bd_1b640a0ddf544592a0f0ec3ce71cdbfa.pdf?index=true
    • https://73dfbb2e-e61d-41e3-b0f0-76cb38fd6df2.filesusr.com/ugd/bc79a4_458511094f264238a1f627ec0bfdefcb.pdf?index=true
    • https://1b2e711b-3772-4e0e-802a-89d17218c9f9.filesusr.com/ugd/7a7fb1_fd1c6afc452f4614bae2d09deb790359.pdf?index=true
    • https://d3f0c222-3d6d-47b1-b421-e883a81fe8da.filesusr.com/ugd/daca0d_8df95d14d7294490ab62dce3ee8c00fa.pdf?index=true
    • https://731f0f06-232e-44a6-830e-05ab73127fb6.filesusr.com/ugd/ebbcbd_77f78b0827454af58124ed8ba5624378.pdf?index=true
    • https://eb8340e4-fc66-4d65-9e72-8a9ca71a8680.filesusr.com/ugd/738632_74d938e9de3b4f9b85f963caf62fde86.pdf?index=true
    • https://e0d710f7-1ef6-4840-a808-d8d5fa211de6.filesusr.com/ugd/d8966e_5f9e8afc74f54134bc7bf0e6d2b70ab2.pdf?index=true
    • https://7a4c677f-97b3-4319-a360-42a4124d752f.filesusr.com/ugd/f523c3_ad179328845d44f4b17cca46bff841aa.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004e25.bin
4bb5d83102db123b5838f392db8d6f2eb288f26a17a93feff82022b1e178f2e0
pdf-font-stream PDF embedded font (sfnt) at offset 0x4E25 5136 bytes
font_01_sfnt_off00005fb1.bin
1514d3361cd29df8d4c1b3ecec281a9521d0e59a6086dd62c65bc24052da2687
pdf-font-stream PDF embedded font (sfnt) at offset 0x5FB1 12064 bytes