Malicious PDF — malware analysis report

Static analysis result for SHA-256 ddd3c866e46f92e3…

MALICIOUS

PDF

57.3 KB Created: 2020-08-30 06:45:26 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fd965f52dc63c78640ef836c66f87826 SHA-1: 10c31a9dfd4107612291ea0a0129d2a4e4d42064 SHA-256: ddd3c866e46f92e3bc51de475cff694300bac68d831227c3e5c8f8ec1c55edef
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs, with one identified as a known malicious redirector. The document body is heavily obfuscated but contains the malicious URL. This indicates a likely attempt to lure users to a malicious site, potentially for phishing or to download further malware. The presence of a link farm suggests a broad distribution strategy.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=c%25C3%25A1ch+l%25E1%25BA%25A5y+m%25C3%25A3+otp+v%25C6%25B0%25C6%25A1ng+qu%25E1%25BB%2591c+x%25C3%25A8ng
    • https://static.usrfiles.com/ugd/fd3290_7b07570e45954b11ae7cdc122907bc8d.pdf
    • https://static.usrfiles.com/ugd/d1c05f_8a7b612262424e4982e582e24245dbd5.pdf
    • https://static.usrfiles.com/ugd/4cf28d_e01e53af471a4e6c9ac04bdc30f5c76b.pdf
    • https://cdn.shopify.com/s/files/1/0431/5938/8320/files/94896601563.pdf
    • https://cdn.shopify.com/s/files/1/0431/4339/7525/files/acls_bradycardia.pdf
    • https://cdn.shopify.com/s/files/1/0435/2363/7399/files/15973130424.pdf
    • https://cdn.shopify.com/s/files/1/0429/2254/1209/files/gafugoxudanizasu.pdf
    • https://static.usrfiles.com/ugd/b8c837_fae4bc71b46c44b0aae9655d242d7e39.pdf
    • https://static.usrfiles.com/ugd/41a0b6_0a800088d524496b8a0fedd6a01b4935.pdf
    • https://static.usrfiles.com/ugd/e32576_6eb507b910f041a7a3a768f4184cb42c.pdf
    • https://static.usrfiles.com/ugd/b8c837_dcdcae093c5d4f0183a0be9bb8c53f65.pdf
    • https://static.usrfiles.com/ugd/b8c837_1c45879901e34e7a9171cf37e6f36f16.pdf
    • https://static.usrfiles.com/ugd/b8c837_503930efaa134338ab701eb24487daf0.pdf
    • https://static.usrfiles.com/ugd/d3758e_e006e6664d0a4ed9b1ce8e6a0b19d3b2.pdf
    • https://static.usrfiles.com/ugd/b8c837_905ba10ac67c468cbc64db95c1d6ab47.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005a63.bin
97f91b92db65b91f107e05696085e54b8483d0e8c693d7493e1f79efae4dc66b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5A63 6516 bytes
font_01_sfnt_off00006e8c.bin
e1c459d54a61e2b557f88a48ef427de239e69155850f4e01ded947d0ee19522b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6E8C 8056 bytes
font_02_sfnt_off00008a9a.bin
a6e3f08d14889a39bbd8a88020422729da58a1d69048455b8810748946e5ee63		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8A9A 21112 bytes
font_03_sfnt_off0000b8bd.bin
d612c605d101522a7b082cd092ef78b209dae850c4a5e940dd0f53fb1bc5669f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB8BD 16148 bytes
font_04_sfnt_off0000cdbc.bin
74be5bc4d46f64e5c506ae1006f7022dc98ebf960e37c7bf417c2027ca73106d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCDBC 1736 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.