Malicious PDF — malware analysis report

Static analysis result for SHA-256 bd590becb2e18edd…

MALICIOUS

PDF

55.8 KB Created: 2020-07-13 01:21:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 353fbd3a304160e788750486ec038b9d SHA-1: 24fae3f63c4c74cb8b9967397c583c3729a64b49 SHA-256: bd590becb2e18edd45159e280e39bf65e7caac4da995cf85ae33d8976fc5ae09
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs, many pointing to Shopify domains, but one critical URL redirects to a known malicious domain. The PDF_MALICIOUS_REDIRECTOR_LINK heuristic confirms this. The ML_NYX_PDF_MALICIOUS score is also extremely high. The document body, though heavily obfuscated, contains keywords related to "occult science pdf" and the authoring application, suggesting a lure for users interested in such content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wb?keyword=occult%20science%20pdf
    • http://files.faithkingwriter.com/uploads/1/3/0/7/130739120/kuvesuva.pdf
    • http://files.coastalvapers.com/uploads/1/3/1/8/131856649/robija.pdf
    • http://files.wildroseworkingbelgians.com/uploads/1/3/1/4/131437044/nipewofewalefux.pdf
    • http://files.oharts.net/uploads/1/3/0/7/130740118/kumewinudep.pdf
    • http://files.faithkingwriter.com/uploads/1/
    • https://cdn.shopify.com/s/files/1/0429/8221/1735/files/zojugozotuj.pdf
    • https://cdn.shopify.com/s/files/1/0428/8957/6601/files/kivasetezoxoluzasas.pdf
    • https://cdn.shopify.com/s/files/1/0431/9546/5892/files/65105707701.pdf
    • https://cdn.shopify.com/s/files/1/0430/1553/6793/files/bezufilixavurasi.pdf
    • https://cdn.shopify.com/s/files/1/0432/6529/4504/files/4363767130.pdf
    • https://luragekid.files.wordpress.com/2020/06/98456287243.pdf
    • https://gimasesagix.files.wordpress.com/2020/07/sopunas.pdf
    • https://nanesezup.files.wordpress.com/2020/07/fodekusiwurimeri.pdf
    • https://cdn.shopify.com/s/files/1/0430/7327/4018/files/wemoxuxeriwelubuxipixok.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/vitalifurefafimeribedewo.pdf
    • https://cdn.shopify.com/s/files/1/0433/8581/5205/files/31073390109.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/72518400380.pdf
    • https://cdn.shopify.com/s/files/1/0430/1615/9381/files/jarate.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/86372263330.pdf
    • https://cdn.shopify.com/s/files/1/0428/4553/6419/files/90269232704.pdf
    • https://cdn.shopify.com/s/files/1/0430/1576/6177/files/sagosinipopixasini.pdf
    • https://cdn.shopify.com/s/files/1/0430/2848/0157/files/65781346483.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00009dfd.bin
72d3ca54d965049701c521011aa60a814fe2cf9adf32527cfbd5c2ef15ec4db2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9DFD 4644 bytes
font_01_sfnt_off0000adda.bin
94f2fa8cf9092cbe5beb30c19db4f33b8f738f5e91a8699836df72097b87c9bd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xADDA 10732 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.