Malicious PDF — malware analysis report

Static analysis result for SHA-256 ce40fd4798edb83b…

MALICIOUS

PDF

36.8 KB Created: 2020-08-31 13:01:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1a0e6b988903f7049ca309b4e66aeb03 SHA-1: ed5837b655b27406a9e33fb760f9dbedc598f09a SHA-256: ce40fd4798edb83bb2f5fd16c07d3b2ebb48e506581a04cc881f56de794bb454
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links, with one identified as a malicious redirector. The document body appears to be obfuscated or corrupted, but the presence of numerous external links, including one pointing to a known malicious redirector (https://ttraff.cc/wix?keyword=poulan+wild+thing+chainsaw+manual), strongly suggests a phishing or SEO poisoning attack. The ML classifier also flagged this PDF with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=poulan+wild+thing+chainsaw+manual
    • https://static.usrfiles.com/ugd/ef253e_c4c2b986a3524a05aabde5963188186a.pdf
    • https://static.usrfiles.com/ugd/a467d2_0c64027518d64c4ebb726dfdae4bd700.pdf
    • https://static.usrfiles.com/ugd/e4ff69_a142429b6ff54edd9b02edc9b1ce68c5.pdf
    • https://static.usrfiles.com/ugd/b8c837_65f5a4aa69d9414ab67941a57846e3ee.pdf
    • https://static.usrfiles.com/ugd/0ebc1f_02fb9df632af459ab921485317440afb.pdf
    • https://static.usrfiles.com/ugd/f0e51d_2f214555ccdf4285b721bcb4035128d3.pdf
    • https://static.usrfiles.com/ugd/aff7ca_5a1fa67995aa4ce0b90b4c51e4d2e5c8.pdf
    • https://static.usrfiles.com/ugd/f09a9d_73e1b18b0043429ebad80ac8190f5c0e.pdf
    • https://static.usrfiles.com/ugd/b8c837_66257352828f40de9e1ca348b0d99223.pdf
    • https://static.usrfiles.com/ugd/58a813_30f850dfb4b842659b7d206bd8ad87e1.pdf
    • https://static.usrfiles.com/ugd/6cf0f5_c67bd0b4235849eba2bc72c614d25703.pdf
    • https://static.usrfiles.com/ugd/ff2e72_984f14d779ad46ffbc3492555934e819.pdf
    • https://static.usrfiles.com/ugd/3615fb_18f1bf9e84844288b5f19ebeabeb650d.pdf
    • https://static.usrfiles.com/ugd/e2f7e1_30ab193a2cd04c67ad28d5d7001f3994.pdf
    • https://cdn.shopify.com/s/files/1/0440/8868/8790/files/alcoholismo_hereditario.pdf
    • https://cdn.shopify.com/s/files/1/0434/7301/0850/files/ipod_shuffle_4th_generation_user_guide.pdf
    • https://cdn.shopify.com/s/files/1/0431/0879/4525/files/libro_el_almohadon_de_plumas_y_otros_cuentos.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000051fc.bin
cddcb404b673d6e0b43f8e7c42fd1c9e3f7bb9677136cb6f5bc18d3a8dab6ab9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x51FC 5348 bytes
font_01_sfnt_off0000641e.bin
61d568a01e1b6f206c8199ae2a2bc73e49b56097e74c965c02e38944c173799a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x641E 10064 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.