Malicious PDF — malware analysis report

Static analysis result for SHA-256 aca2536ed79a702a…

MALICIOUS

PDF

45.3 KB Created: 2020-10-17 11:03:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: cc02af212939a0599232f5399623923d SHA-1: a53134013f7a5eda1091877e9db586041ba58b9a SHA-256: aca2536ed79a702acaae1348d27405f498ea10fac093bc59e9c3ee3c1074698d
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a mass of external links, including one pointing to a known malicious redirector infrastructure. The document body text, though heavily obfuscated, contains keywords related to 'editing pdf on macbook' and includes the malicious URL, suggesting a lure to trick users into clicking the link. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/123?keyword=editing+pdf+on+macbook
    • https://saxexowiki.weebly.com/uploads/1/3/0/9/130969873/kinariwujupob.pdf
    • https://mamexobupelo.weebly.com/uploads/1/3/1/3/131383482/xijanatokimes.pdf
    • https://korodaziso.weebly.com/uploads/1/3/0/7/130740443/ad035489b3d.pdf
    • https://cdn-cms.f-static.net/uploads/4369788/normal_5f8a97d4aae3b.pdf
    • https://cdn-cms.f-static.net/uploads/4368243/normal_5f89d2501b49f.pdf
    • https://cdn-cms.f-static.net/uploads/4369930/normal_5f881658c8158.pdf
    • https://cdn-cms.f-static.net/uploads/4366312/normal_5f8724a6a5db6.pdf
    • https://cdn-cms.f-static.net/uploads/4371025/normal_5f8a041044981.pdf
    • https://uploads.strikinglycdn.com/files/985b5e86-3a60-4464-9aa6-96a3d52fb794/surugapugopogusupamubor.pdf
    • https://uploads.strikinglycdn.com/files/6da91443-b5a0-4d3e-bd62-f1535004f138/goxon.pdf
    • https://uploads.strikinglycdn.com/files/c6ffc8cd-120a-4792-ac30-7d723f14cdb9/66492762889.pdf
    • https://uploads.strikinglycdn.com/files/e71f0923-991f-4a09-a3ef-68e5646aa38f/43336491567.pdf
    • https://cdn.shopify.com/s/files/1/0497/1534/7617/files/vefedunasojujusa.pdf
    • https://cdn.shopify.com/s/files/1/0500/3191/9254/files/71622679252.pdf
    • https://cdn.shopify.com/s/files/1/0495/9748/1123/files/gawapoxupomorolexuf.pdf
    • https://cdn.shopify.com/s/files/1/0502/9511/1845/files/dreams_of_desire_apkpure_download.pdf
    • https://cdn.shopify.com/s/files/1/0497/3769/5393/files/navy_chief_petty_officer_mission_vision_and_guiding_principles.pdf
    • https://cdn.shopify.com/s/files/1/0502/7079/8007/files/terraria_repair_guide_house.pdf
    • https://cdn.shopify.com/s/files/1/0486/0533/1616/files/battleground_targets_replacement.pdf
    • https://cdn.shopify.com/s/files/1/0483/0432/4772/files/newow.pdf
    • https://cdn.shopify.com/s/files/1/0482/7804/4834/files/who_is_the_king_of_glory_gospel_song.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://cdn.shopify.com/s/files/1/0482/7804/4834/files/who_is_the_king_of_glory_gospe

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000727a.bin
b6be93d2c23d0131f2e230dc655878eeabc4fa7c8f9415bceaf6748a5f5eab4d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x727A 5328 bytes
font_01_sfnt_off0000848d.bin
a69499fc524f4b11b389f29e8dfeaa983ac60b7fe3eb7387ea88a3ab633494d0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x848D 10808 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.