Malicious PDF — malware analysis report

Static analysis result for SHA-256 be00869b365b74cd…

MALICIOUS

PDF

46.8 KB Created: 2020-08-12 23:56:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: def25dacdc9621b2a2e87ad377431e08 SHA-1: ce6a15153f623bbf228083201849a9874e982f1c SHA-256: be00869b365b74cd1060438c7ebe1376c9354874c91f9ab47586876bdeb42e9d
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links, with one specifically pointing to a known malicious redirector. The ML classifier also strongly indicated maliciousness. The document body, though heavily obfuscated, contains the same suspicious URL found in the heuristics, suggesting the primary purpose is to lure users to malicious sites. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=int%25C3%25A9grale+double+coordonn%25C3%25A9es+polaires+pdf
    • http://files.gaeunkim.com/uploads/1/3/2/8/132815003/vezafugik-bibosu-zapavarijen-xawagovomeroju.pdf
    • http://dobux.gameworldparty.com/uploads/1/3/0/7/130775413/557587.pdf
    • http://retep.weeadventures.com/uploads/1/3/0/7/130739573/xidun.pdf
    • http://files.henhouseart.co.uk/uploads/1/3/0/9/130969293/jotafun.pdf
    • http://files.scoilursula.com/uploads/1/3/1/1/131163494/c339bb01789ffc.pdf
    • https://cdn.shopify.com/s/files/1/0434/0852/3416/files/24269176741.pdf
    • https://cdn.shopify.com/s/files/1/0433/6451/5994/files/rubir.pdf
    • https://cdn.shopify.com/s/files/1/0432/1037/5325/files/93678471835.pdf
    • https://cdn.shopify.com/s/files/1/0434/7219/1641/files/zulubexadokomobepuzep.pdf
    • https://cdn.shopify.com/s/files/1/0431/6885/8272/files/difawedidizufesebomo.pdf
    • https://cdn.shopify.com/s/files/1/0436/8711/6965/files/tirepedusawoje.pdf
    • https://cdn.shopify.com/s/files/1/0428/5127/0815/files/tf2_player_count.pdf
    • https://cdn.shopify.com/s/files/1/0428/9432/7961/files/pabifawodejumetede.pdf
    • https://cdn.shopify.com/s/files/1/0433/1978/7688/files/ba_1st_year_history_book.pdf
    • https://cdn.shopify.com/s/files/1/0430/9073/9361/files/first_and_third_angle_orthographic_projection.pdf
    • https://cdn.shopify.com/s/files/1/0438/2756/0598/files/mathematics_for_economic_analysis_by_sydsaeter_and_hammond.pdf
    • https://cdn.shopify.com/s/files/1/0428/3714/7811/files/lonafidum.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000069b2.bin
e0f2c7623eb7f3d5573d5cfe21741b4573e38639b62348c6bdf3fa85dd6703ac		 pdf-font-stream PDF embedded font (sfnt) at offset 0x69B2 5540 bytes
font_01_sfnt_off00007c40.bin
0fa2c9c456d0830a981335c7d24add0dfae4dee2f8ed4b9e1f71d9a686dd7b2e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7C40 15836 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.