Malicious PDF — malware analysis report

Static analysis result for SHA-256 ba5681dbf57706d4…

MALICIOUS

PDF

40.7 KB Created: 2020-09-17 01:12:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a92f9b730d2d62129610cbd07db8b78d SHA-1: 3bd5f1605c081332eeeadcb718645364f7dd17b8 SHA-256: ba5681dbf57706d49426d3516082708d972d1921c6c813352bb66b154548b450
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a link that redirects to a malicious URL, disguised as a biochemistry lab manual. The PDF also contains a large number of links to other PDF files, likely for SEO manipulation to increase visibility. The ML classifier strongly indicated maliciousness. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=biochemistry+lab+manual+for+mbbs+pdf
    • http://files.girlbossevents.com/uploads/1/3/1/4/131482881/488319.pdf
    • http://files.brightonbannershop.co.uk/uploads/1/3/2/6/132681951/14595fb2.pdf
    • http://files.kmbaudier.com/uploads/1/3/1/1/131163664/4b74e90b.pdf
    • http://files.comcomnetworksw.com/uploads/1/3/1/1/131163867/5685308b2c.pdf
    • http://files.camayacoastbeachproperties.com/uploads/1/3/0/7/130740242/ligezudejikal.pdf
    • https://684f2967-68c0-47e8-8385-0414401560a0.filesusr.com/ugd/031dda_074db1f2082f43c69ea25643ff7390d6.pdf?index=true
    • https://c43092a8-5ce1-4854-807f-3f76f5c87ebe.filesusr.com/ugd/5b5da7_a631077243004174989d80f56d54c3d4.pdf?index=true
    • https://9aac3286-7712-4f90-88c6-35b4f31a1374.filesusr.com/ugd/db80c5_d52e4662fd59497ead112e8f695ce440.pdf?index=true
    • https://414a4103-692f-4a09-85b5-88fc6f3a92df.filesusr.com/ugd/46bfb0_c79f91905e8e41b4b6b882437023d172.pdf?index=true
    • https://cdn.shopify.com/s/files/1/0434/3375/4773/files/android_collapsing_toolbar_with_tablayout.pdf
    • https://cdn.shopify.com/s/files/1/0434/4905/7430/files/sepipazezerulanu.pdf
    • https://cdn.shopify.com/s/files/1/0430/9437/6605/files/zezekuzeruzogufizip.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/71895612735.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000048e4.bin
bbb846cdc2f5b49a0f70bf3335164259081eea60fe8aed50e59f05d9337027ab		 pdf-font-stream PDF embedded font (sfnt) at offset 0x48E4 5688 bytes
font_01_sfnt_off00005c14.bin
74670cc0c0044556dcd25b372c971d72964a6e6ea684e4c82e2089dbc249eff2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5C14 10248 bytes
font_02_sfnt_off00007f37.bin
6e3fbd491d8b71441998836ddca0d0c102716a221ea14f8143929167ad9a79b3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7F37 16164 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.