Malicious PDF — malware analysis report

Static analysis result for SHA-256 c4c833d49beb6e78…

MALICIOUS

PDF

52.4 KB Created: 2020-08-04 15:58:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c5d657c1740b1c520af5316c7ba6468d SHA-1: 58d859146929d75489f8e481e2b786e98b46a7af SHA-256: c4c833d49beb6e78021640a7efd7dc77f1ff89f31a2164c0a57c120e4a203e06
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links, with one identified as a malicious redirector. The heuristic PDF_SEO_LINK_FARM indicates a link farm strategy, likely to manipulate search results or distribute further malicious content. The ML classifier strongly supports the malicious verdict. No scripts were extracted, but the primary attack vector appears to be the extensive use of malicious and SEO-optimized links within the document.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=cours+anglais+6%25C3%25A8me+pdf
    • http://files.dianamariarossiart.com/uploads/1/3/1/6/131636586/84d11c6cb.pdf
    • http://dubimo.esslondon.ca/uploads/1/3/0/7/130775448/nutekof.pdf
    • http://files.cosyyeti.com/uploads/1/3/1/3/131380440/fozijonog.pdf
    • https://cdn.shopify.com/s/files/1/0436/0136/3107/files/74882967600.pdf
    • https://cdn.shopify.com/s/files/1/0433/8037/5708/files/lepowerorevunisa.pdf
    • https://cdn.shopify.com/s/files/1/0434/5980/5350/files/87581949498.pdf
    • https://cdn.shopify.com/s/files/1/0433/5455/4533/files/49834270163.pdf
    • https://cdn.shopify.com/s/files/1/0439/8972/9438/files/jujijujagofemokorazijek.pdf
    • https://cdn.shopify.com/s/files/1/0432/4858/2820/files/87876458314.pdf
    • https://cdn.shopify.com/s/files/1/0438/8945/9368/files/kalatusobum.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/muxolalinurijelibabozafod.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/65545430121.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/dedapefe.pdf
    • https://cdn.shopify.com/s/files/1/0437/0844/8919/files/xazuvuguxukike.pdf
    • https://cdn.shopify.com/s/files/1/0437/3676/0485/files/87795761872.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006c5a.bin
8522561e56dc4aa1e24d7f8194443676aac5772b18dc1a4e09752b78bde05f58		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6C5A 6504 bytes
font_01_sfnt_off00007c90.bin
052a052f4f1b41274081cd6353136bacb1f9d59f2db1c5c6ab501c1b980d2e09		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7C90 5480 bytes
font_02_sfnt_off00008ed5.bin
8f94ff35d176b1dfee391b571e98c532fbe55fed46f02e6c4646c49f7e0d3285		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8ED5 11968 bytes
font_03_sfnt_off0000b467.bin
0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB467 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.