Malicious PDF — malware analysis report

Static analysis result for SHA-256 b5b9ee72a13453fc…

MALICIOUS

PDF

46.9 KB Created: 2020-09-17 03:42:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d26a5a0e5308941a966bb59d9ec09ad4 SHA-1: 54aee04536dd44f8219e20cbf1b3f41292993b89 SHA-256: b5b9ee72a13453fc0cf668a9ecb6bccb06d9b86c34b545bbbeae7894edc1a7d3
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged as malicious by a machine learning classifier and contains numerous embedded links, including one pointing to a known malicious redirector. The document body, though heavily obfuscated, contains references to URLs that are also present in the extracted URL list. This suggests a campaign to lure users to malicious sites, likely for phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/wix?keyword=count+dracula+1970+rotten+tomatoes
    • http://kuramuw.magbazpictures.com/uploads/1/3/0/8/130874642/judosu.pdf
    • http://files.softwareoracles.com/uploads/1/3/1/8/131871705/8c1f82.pdf
    • http://files.hollytravislabatiup.org/uploads/1/3/0/7/130775565/bamafumukusisuvuso.pdf
    • http://files.thegalaxygemsboutique.com/uploads/1/3/2/3/132303269/samak.pdf
    • http://files.freharrodcorporation.com/uploads/1/3/0/9/130969298/jowetabivawame-joliluridisa.pdf
    • https://b1e038cc-6d85-4681-8ff6-d381a7c469e3.filesusr.com/ugd/cf5aa9_08ffde7a10194e44b435e66897c19f67.pdf?index=true
    • https://4aca54f2-f333-4569-aa71-b8e1bf327d4b.filesusr.com/ugd/daca0d_bcf7881f7f72432b97dfa44918a3a4de.pdf?index=true
    • https://393f0cd1-b0ed-498b-9ef2-b6125ab890be.filesusr.com/ugd/1cc7e8_4d1d7aa713a94c15a7ac53edac88dd2e.pdf?index=true
    • https://371a9278-b46e-43bc-8794-9b1308c0fa4f.filesusr.com/ugd/1b6cec_49683d174af54a96b728e22ee0f13b78.pdf?index=true
    • https://2912bd41-9a3a-4b02-8cf1-b0f7bc72fb4b.filesusr.com/ugd/6924eb_815fbdc8aa7349db81e48fd6e215654e.pdf?index=true
    • https://7d23c985-1547-4f72-adec-68b9fc399020.filesusr.com/ugd/34e21e_95df96febc0d40c38158c9ba240fb4b7.pdf?index=true
    • https://9fffb58c-356f-41df-b51f-4622e1ddb24a.filesusr.com/ugd/067ecb_7a6ae71c0e674b33ac636bc1b615a216.pdf?index=true
    • https://b4437439-90fd-447d-8f06-314ce39233cc.filesusr.com/ugd/f3cb45_0663d8f3fcbb4673abc58a45a51eb896.pdf?index=true
    • https://9060f600-c04a-4ec0-b9ce-4123f57100e1.filesusr.com/ugd/45fd81_be09878fdae14047aff6b81bc691e6c7.pdf?index=true
    • https://404a488c-dc49-42ce-a59f-753b6a2f24e6.filesusr.com/ugd/e2f7e1_92a81215f3cb460a9f7d77514f5292ee.pdf?index=true
    • https://334c296e-c51b-44e7-80e8-34af405390d3.filesusr.com/ugd/78c764_44b92ac173e24ff88bfc597295fb92bf.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000781c.bin
e2110591d9ab120d17fdab54ca78ef06b8f3d6c177790a5cea717b0c0c6a02c0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x781C 5420 bytes
font_01_sfnt_off00008a75.bin
be501ef63fa3dc837a48332f752a7096a794a0611079f3c64218f83502e04a14		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8A75 10580 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.