Malicious PDF — malware analysis report

Static analysis result for SHA-256 a9e402808194014e…

MALICIOUS

PDF

49.2 KB Created: 2020-09-07 05:49:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 16c8a5bd5139ba071c1a25c45f169417 SHA-1: d6bea9c607fef2d8461bcbeb8fe4b00b5e0dc40f SHA-256: a9e402808194014e61f54c1c113791335d830b8b89f944fb6f753cf9456ab304
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a mass external link farm, with a primary URL pointing to a known malicious redirector. The document body, though heavily obfuscated, contains text related to 'B tech computer science books pdf' and the malicious URL, suggesting a lure to trick users into clicking the link. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=b+tech+computer+science+books+pdf
    • https://static.usrfiles.com/ugd/286fb8_2294ea3917fd4110be3a593380a23820.pdf
    • https://static.usrfiles.com/ugd/b8c837_10bbf1f3083b4508a2fc06a12fa4fd97.pdf
    • https://static.usrfiles.com/ugd/724bd4_9832b9a69ff344a695944c0cf92c468f.pdf
    • https://static.usrfiles.com/ugd/d2057d_7199357f31024f93b3db0c5a3b66975b.pdf
    • https://static.usrfiles.com/ugd/5926b4_f38e475853f24671bed0ab81ff6cf5b2.pdf
    • https://cdn.shopify.com/s/files/1/0431/8137/5648/files/autocad_2014_product_key_generator_free.pdf
    • https://cdn.shopify.com/s/files/1/0429/6241/9863/files/mapamundi_mudo_politico_para_imprimir.pdf
    • https://cdn.shopify.com/s/files/1/0432/6873/5140/files/35833923833.pdf
    • https://cdn.shopify.com/s/files/1/0434/7500/9686/files/can_you_albums_on_apple_music.pdf
    • https://cdn.shopify.com/s/files/1/0430/7396/2145/files/examen_segundo_grado_bloque_1_2017.pdf
    • https://static.usrfiles.com/ugd/bd7df1_b9b3219ad9d4406b8ef05f5feae8bb69.pdf
    • https://static.usrfiles.com/ugd/1849a1_94334bcc00864104a9d002335f000bbd.pdf
    • https://static.usrfiles.com/ugd/eb4c03_8c864c572e3042cc953f2f63c30d1658.pdf
    • https://static.usrfiles.com/ugd/8d0191_0996933848084e8da480a4713caa163d.pdf
    • https://static.usrfiles.com/ugd/07e02c_856e295e78094f5182b976a3c8a92e13.pdf
    • https://cdn.shopify.com/s/files/1/0451/0354/6533/files/business_model_canvas_spanish.pdf
    • https://cdn.shopify.com/s/files/1/0439/2108/0475/files/believers_bible_commentary.pdf
    • https://cdn.shopify.com/s/files/1/0437/8597/8018/files/flvs_spanish_2_midterm_answers.pdf
    • https://cdn.shopify.com/s/files/1/0432/6716/2276/files/tefalapomemi.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008135.bin
6739a3b143688b728f864bc9348321efc48caf39c61fb1f30b2f9e69db20af0e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8135 5408 bytes
font_01_sfnt_off0000936c.bin
0b19aa6e18b6ac349a74a85815a11989c5533101f21342a1aa69828601521553		 pdf-font-stream PDF embedded font (sfnt) at offset 0x936C 10940 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.