Malicious PDF — malware analysis report

Static analysis result for SHA-256 cd2bdddbaed54d83…

MALICIOUS

PDF

44.3 KB Created: 2020-09-05 18:37:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: beb491481fe0de4cd0cbdaa0ef019432 SHA-1: 5f5b13301d57aa45615464d6963116c0f51b7f93 SHA-256: cd2bdddbaed54d8350f2c055ccfe1d37846910e36d358cafac5ccecadfbe7c3b
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains numerous embedded links, with one prominent link directing to a known malicious redirector. The document body, though heavily obfuscated, contains text fragments that suggest a lure related to 'Leopard gecko morph breeding guide'. The presence of a malicious redirector URL and the link farm heuristic strongly indicate a phishing or redirection attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/wix?keyword=leopard+gecko+morph+breeding+guide
    • https://static.usrfiles.com/ugd/bf650e_ced4fb95d154497382f58aab9b9b56a2.pdf
    • https://static.usrfiles.com/ugd/ea78e0_08902737da274593be2d4ec2b2535bed.pdf
    • https://static.usrfiles.com/ugd/4117a9_6f4938433523428284ece47614315bc5.pdf
    • https://static.usrfiles.com/ugd/ee9d3f_528d2911c4be4b33ae47a70da562ca8a.pdf
    • https://static.usrfiles.com/ugd/b8c837_4a8e8b88ce3f42ecaa4fc7149577fd9a.pdf
    • https://static.usrfiles.com/ugd/74e9cf_d0d1c28bce70472b88db37a6c82ccd8a.pdf
    • https://static.usrfiles.com/ugd/e3ff21_883824ca45af4292851fc781973bc86a.pdf
    • https://static.usrfiles.com/ugd/217b8a_1702d37225ad48b8847df1968d9d4e18.pdf
    • https://static.usrfiles.com/ugd/fd30ac_9a0d1f938af24ee3868a15d6d2c41d5b.pdf
    • https://static.usrfiles.com/ugd/c75f60_4baef38ce8d54f188f81b61ef89a03d3.pdf
    • https://static.usrfiles.com/ugd/b8c837_5b3e3476ad4f4cc5b258b42e6c0d6d8a.pdf
    • https://static.usrfiles.com/ugd/4dd980_2a9b67662fc4412a852897e4fc8a6de2.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006f19.bin
b246371870a1ddde3410a1b7c2cf7b455996e4b0491f13c47b9a3b8e282f4db9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6F19 5424 bytes
font_01_sfnt_off00008163.bin
ccf8e60f4790ed91b2015fb50a9b3592712313a89443a0f80934019bbfe85f2d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8163 10316 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.