Malicious PDF — malware analysis report

Static analysis result for SHA-256 b0018bdc79e54c53…

MALICIOUS

PDF

51.5 KB Created: 2020-07-14 21:13:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1f2b9a45fb9df957318f74a6e45710ab SHA-1: 0d0c8fc6afee1f76fd4dd5c9d476231c280dce37 SHA-256: b0018bdc79e54c5361f8eb9f0f2281d2cb560a237bb9fc5a7414667b4b13fd9c
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by a machine learning classifier with high confidence. It contains a significant number of embedded URLs, with at least one pointing to known malicious redirector infrastructure. The document body appears to be garbled, but the presence of numerous links suggests a lure to external malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wb?keyword=tn%20pollution%20control%20board%20recruitment%202019%20notification%20pdf
    • http://files.kamsportswear.com/uploads/1/3/2/6/132695865/tavefefunavus-zavepelatijex.pdf
    • http://files.heavygrail.net/uploads/1/3/1/3/131380733/bitat.pdf
    • http://files.aiwonglawyers.com/uploads/1/3/1/4/131437119/784833.pdf
    • http://files.katherinebholland.com/uploads/1/3/1/4/131407233/xotiparafonalop_nakobibetiriwop_konoganebu.pdf
    • http://files.jasmarezcats.com/uploads/1/3/1/4/131454986/53bddf794a8ed84.pdf
    • http://files.maxeyshouse.com/uploads/1/3/2/6/132681713/9099627.pdf
    • http://files.jennifercronk.com/uploads/1/3/0/8/130813461/7555371.pdf
    • http://files.jennifercronk.com/uploads/1/3/0/8/1308
    • https://vefezuvori.files.wordpress.com/2020/07/64687918170.pdf
    • https://jilizivi90208617.files.wordpress.com/2020/07/dumofepazolotigigan.pdf
    • https://vurezonu.files.wordpress.com/2020/07/zokukoji.pdf
    • https://gorowedezer.files.wordpress.com/2020/06/60008120156.pdf
    • https://cdn.shopify.com/s/files/1/0431/6640/0663/files/42154972202.pdf
    • https://cdn.shopify.com/s/files/1/0433/5327/6574/files/ridumugo.pdf
    • https://cdn.shopify.com/s/files/1/0431/7731/2411/files/7583323313.pdf
    • https://cdn.shopify.com/s/files/1/0433/5190/0310/files/23168314437.pdf
    • https://cdn.shopify.com/s/files/1/0433/0602/5128/files/96287147095.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/33540287451.pdf
    • https://cdn.shopify.com/s/files/1/0432/6617/9230/files/58729962101.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/pafinekumukomotutawewokab.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000077d6.bin
7db5728fd1b8b95f9669530e3cdd0c6877d2c4196b79d4290fa215231e419de5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x77D6 5576 bytes
font_01_sfnt_off00008aa7.bin
938f241e4d7897a872ca75ce3dc83df455076cc6d15bc551e880596f785fe0c0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8AA7 4360 bytes
font_02_sfnt_off00009a0d.bin
046f61cdf72e436a0e1325fc1e86754de1a47fe68ba3a93d28ac03506ce2f225		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9A0D 10256 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.