Malicious PDF — malware analysis report

Static analysis result for SHA-256 e28d791dffea6a62…

MALICIOUS

PDF

56.8 KB Created: 2020-08-12 15:07:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bb43354a1c12d0ad2feff53e2eb9bf39 SHA-1: fa84c7844440e7654f9097d36caea3134e1ccf38 SHA-256: e28d791dffea6a62371e5d3d5bebdcb2738f35eafd8d16cad936cd7db30ee57b
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains numerous embedded links, with one specifically pointing to a known malicious redirector. The 'PDF_MALICIOUS_REDIRECTOR_LINK' and 'PDF_SEO_LINK_FARM' heuristics indicate a deliberate attempt to direct users to potentially harmful sites. The ML classifier also strongly flagged this PDF as malicious. The document body, though partially corrupted, contains text related to 'business process documentation' and a URL that mirrors the malicious redirector.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=business+process+documentation+example+pdf
    • http://files.dirtyapron.co/uploads/1/3/1/3/131382239/6255773.pdf
    • http://files.smgengr.com/uploads/1/3/2/6/132695730/vikamu_gevipetewamutol.pdf
    • http://pagikesoz.beadsbybrandy.com/uploads/1/3/0/7/130738732/7935026.pdf
    • http://files.mplsalpineski.org/uploads/1/3/0/7/130775341/lekafinigijuwupob.pdf
    • https://cdn.shopify.com/s/files/1/0428/3406/7615/files/el_capitalismo_historico.pdf
    • https://cdn.shopify.com/s/files/1/0430/5797/1354/files/xodumebazuxopovajexenesex.pdf
    • https://cdn.shopify.com/s/files/1/0427/6797/4556/files/the_celluloid_closet_vito_russo.pdf
    • https://cdn.shopify.com/s/files/1/0437/1313/4743/files/xevulir.pdf
    • https://cdn.shopify.com/s/files/1/0429/6949/7753/files/64188484316.pdf
    • https://cdn.shopify.com/s/files/1/0433/3436/9438/files/mysql_php.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/93366398369.pdf
    • https://cdn.shopify.com/s/files/1/0427/8665/2316/files/tugelofufuxazi.pdf
    • https://cdn.shopify.com/s/files/1/0451/0197/3657/files/bernt_oksendal_stochastic_differential_equations.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/26450283228.pdf
    • https://cdn.shopify.com/s/files/1/0435/3448/3605/files/39335367675.pdf
    • https://cdn.shopify.com/s/files/1/0432/8944/4510/files/zavowufinok.pdf
    • https://cdn.shopify.com/s/files/1/0429/9168/1699/files/womulanoge.pdf
    • https://cdn.shopify.com/s/files/1/0430/8946/1410/files/27203458212.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000072ae.bin
ba9397cbb3a8a0f100a11843ac95cdbef8c213e8a711b39be5fd8223ab4f4eee		 pdf-font-stream PDF embedded font (sfnt) at offset 0x72AE 5420 bytes
font_01_sfnt_off000084f4.bin
76771e389b81067b04f95b2a73a124afbe26a973ddcf163bf84804ec2cdf638f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x84F4 7424 bytes
font_02_sfnt_off00009991.bin
21fb7e66be4a20e4a0fecc5dde357bc7ca7a8c52dfbf6a26a19fe9bbcc26d8f6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9991 10272 bytes
font_03_sfnt_off0000bcdc.bin
3dc88664ad88edbb49b52bd74c7fb7fff5994ec604a54008f2841cfefa279f18		 pdf-font-stream PDF embedded font (sfnt) at offset 0xBCDC 17176 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.