Malicious PDF — malware analysis report

Static analysis result for SHA-256 cb27a62f499157ca…

MALICIOUS

PDF

48.7 KB Created: 2020-09-05 18:44:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: dea5344bc680d654e8e0b3d0ac0e960e SHA-1: 50a4693d07ead7eb7d2af8a49cccb116ec0705c8 SHA-256: cb27a62f499157caa9ba8308788ba58b93fdd9442b3e18ecbaa6de8c9273195b
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains numerous embedded links, with a critical heuristic firing for a malicious redirector. The document body, though heavily obfuscated, contains text that appears to be a lure for popular video content. The primary malicious IOC is the redirector URL, which is designed to lead users to further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/wix?keyword=wanted+bhojpuri+movie+video+song++tinyjuke
    • https://static.usrfiles.com/ugd/18122d_8a14b1ea04d9454688ccafd364805ea2.pdf
    • https://static.usrfiles.com/ugd/575363_1d8b371495ab4df68eeb51d78b305067.pdf
    • https://static.usrfiles.com/ugd/16a96a_ed8973fba62548688ef8d6c337bab5b0.pdf
    • https://static.usrfiles.com/ugd/96564c_0297f4d0fd3946a6904918f52aed9c5a.pdf
    • https://cdn.shopify.com/s/files/1/0432/4684/6119/files/34068084601.pdf
    • https://cdn.shopify.com/s/files/1/0430/3945/7429/files/xamegubomelefi.pdf
    • https://cdn.shopify.com/s/files/1/0437/0549/9803/files/2085957519.pdf
    • https://cdn.shopify.com/s/files/1/0431/6951/3632/files/zazisogexarivepisidoz.pdf
    • https://cdn.shopify.com/s/files/1/0432/1712/5536/files/smoked_beef_brisket_nutritional_information.pdf
    • https://cdn.shopify.com/s/files/1/0463/1271/8498/files/97422254451.pdf
    • https://cdn.shopify.com/s/files/1/0433/4741/1096/files/coordinate_plane_activities.pdf
    • https://cdn.shopify.com/s/files/1/0429/4829/6863/files/sabikasa.pdf
    • https://cdn.shopify.com/s/files/1/0429/9925/1097/files/calculus_1_practice_problems_pdf.pdf
    • https://cdn.shopify.com/s/files/1/0445/4078/8895/files/maths_formulas_for_class_11_download.pdf
    • https://cdn.shopify.com/s/files/1/0435/1403/6383/files/31025172752.pdf
    • https://cdn.shopify.com/s/files/1/0435/5925/6232/files/banoge.pdf
    • https://cdn.shopify.com/s/files/1/0431/5466/9729/files/kudunakejukofaw.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000051a4.bin
138b1743da9e0ad5de48e7cfefa82f7069a9d50382d72a05dc072d46fcf94b5c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x51A4 5796 bytes
font_01_sfnt_off00006548.bin
0a1291090bfa5aa5c56faf951f73376164e0e29f43f00ddd7dae0bac0be6589d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6548 13120 bytes
font_02_sfnt_off00008e6c.bin
ebd2804bff382343e08f6a42dc45f69f4e794c08b23908ae60ba78ededae74b1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8E6C 16164 bytes
font_03_sfnt_off0000a3c0.bin
fc28662967d6a06566a1768e3ec30843f6320db84b2c09dbfe7ace607e0545b9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA3C0 4724 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.