Malicious PDF — malware analysis report

Static analysis result for SHA-256 c1d66cd9627b9429…

MALICIOUS

PDF

45.9 KB Created: 2020-08-26 10:41:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bc8fc72fe762710f4aa039fd898c4b02 SHA-1: 41f2e81ff19a0c02350ded7f47ebcc6e53acfe12 SHA-256: c1d66cd9627b94296a01aaa52cc9993d254dee824b7c37243eabe93adf21dc18
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a prominent link that redirects to a malicious URL, disguised as a game download guide. This heuristic firing, combined with the ML classifier's high confidence, indicates a malicious redirection attempt. The document body contains garbled text but includes the target URL, reinforcing the malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=gta+4+kurulumsuz+nas%25C4%25B1l+indirilir
    • http://files.youdesignleather.com/uploads/1/3/2/6/132682585/masebut_gawotumobavo_sivavule.pdf
    • http://files.grandfinaleeventsanddecor.com/uploads/1/3/0/9/130969573/zejidebivu.pdf
    • http://kagoboda.caringforzebras.com/uploads/1/3/0/9/130969408/xipejuf_jowoguvojezokij_kowiriro.pdf
    • http://files.minnesotauruguaypartners.org/uploads/1/3/1/8/131856602/dexavolopenen_nemejaxawosagav_duxibubokezivo_sixokuduwuxora.pdf
    • https://cdn.shopify.com/s/files/1/0434/1828/8285/files/xudotareninajowonaw.pdf
    • https://cdn.shopify.com/s/files/1/0439/1983/5304/files/leminowuze.pdf
    • https://cdn.shopify.com/s/files/1/0431/4939/4080/files/wekevubilovexafiletepo.pdf
    • https://cdn.shopify.com/s/files/1/0435/0109/3030/files/rirafaj.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/wexanenivoxepabulolud.pdf
    • https://cdn.shopify.com/s/files/1/0466/5924/0101/files/gadowupa.pdf
    • https://cdn.shopify.com/s/files/1/0437/5176/8225/files/balusokas.pdf
    • https://cdn.shopify.com/s/files/1/0431/5355/5610/files/25497240786.pdf
    • https://cdn.shopify.com/s/files/1/0429/4852/6246/files/sowikijabaxuwekezi.pdf
    • https://cdn.shopify.com/s/files/1/0428/2092/7655/files/lilepidosibakigezufajaj.pdf
    • https://cdn.shopify.com/s/files/1/0435/1492/1112/files/zewano.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005412.bin
99f545e7e3b1c5b9ee99eb5170b962b44e8c72b6b3f3ad44fcb632c8f1f1b5db		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5412 5236 bytes
font_01_sfnt_off000065d5.bin
daad3f347a4f42f432ee9983e619a7c063e36761dba5934b469418034847e28e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x65D5 1800 bytes
font_02_sfnt_off00006e63.bin
439a7392ab1ae5a0d895d1eec94328a154dcdc0fea9d54bd1cbb8932d120749b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6E63 11732 bytes
font_03_sfnt_off00009307.bin
d78d7cc1a68daa951b4fbccbcfb906d5a08ad384f187125596154666a45abe72		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9307 16060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.