Malicious PDF — malware analysis report

Static analysis result for SHA-256 e4be5a8005c65efc…

MALICIOUS

PDF

68.5 KB Created: 2020-08-06 19:26:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d9a95e78b2e8fd4f480cc5b7030c9008 SHA-1: 33d765d4d31b7708f61e13fe04330f917af38b18 SHA-256: e4be5a8005c65efca4031458bbe77a270039b3f389c4e32b294e200a6a16e7aa
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF contains numerous embedded links, with a critical heuristic identifying a link to a known malicious redirector. The document body, though heavily obfuscated, contains a URL that matches the redirector. This suggests the document is designed to redirect users to malicious content, likely for phishing or malware distribution. No scripts were extracted, limiting the analysis of specific execution behaviors.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=normas+abnt+referencias+bibliograficas+pdf
    • http://files.sylvainetlesfilles.com/uploads/1/3/2/7/132741241/gupaxafigurude.pdf
    • http://files.bringmorehappy.com/uploads/1/3/1/4/131454355/50bca6bb3839ba1.pdf
    • http://setezi.viktoraskubaitis.com/uploads/1/3/0/9/130969592/vuzizisalidif_nurasoza_zowigites_zelafexuxonizi.pdf
    • http://files.moredoorclassics.com/uploads/1/3/0/7/130738928/zavamilil_zibukaguzozizo_juredimerap.pdf
    • https://cdn.shopify.com/s/files/1/0433/8991/1194/files/8100690512.pdf
    • https://cdn.shopify.com/s/files/1/0428/6775/3116/files/nirevo.pdf
    • https://cdn.shopify.com/s/files/1/0430/0383/8615/files/62513689700.pdf
    • https://cdn.shopify.com/s/files/1/0435/1878/7743/files/76605681634.pdf
    • https://cdn.shopify.com/s/files/1/0434/4555/1256/files/89353233056.pdf
    • https://cdn.shopify.com/s/files/1/0435/5283/3687/files/linear_circuit_analysis_decarlo.pdf
    • https://cdn.shopify.com/s/files/1/0436/0100/2664/files/jawapitaxolaminul.pdf
    • https://cdn.shopify.com/s/files/1/0428/3318/2886/files/portugues_brasileiro_para_estrangeiros.pdf
    • https://cdn.shopify.com/s/files/1/0433/0484/5465/files/65433077087.pdf
    • https://cdn.shopify.com/s/files/1/0429/3813/8783/files/49952247225.pdf
    • https://cdn.shopify.com/s/files/1/0432/0778/6654/files/kuxomevad.pdf
    • https://cdn.shopify.com/s/files/1/0434/6304/9376/files/averaging_amplifier.pdf
    • https://cdn.shopify.com/s/files/1/0427/7954/1671/files/webake.pdf
    • https://cdn.shopify.com/s/files/1/0438/0151/0045/files/mogonez.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://cdn.shopify.com/s/files/1/0434/4555/1256/files/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000bd4f.bin
2b9701441ca000b08c2813443f580083f0aa7f2f4ae9f5f81a34dd73cbe849f0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xBD4F 5584 bytes
font_01_sfnt_off0000d02c.bin
e2f5d3ef3d159c4618a897938a4514967e3e9e15e90b00f9078329914e8d563d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD02C 1812 bytes
font_02_sfnt_off0000d909.bin
6d7b9b9d158758f195ae5d45646c3240b306917c7792e8cf273bf1b6dc0fd974		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD909 12976 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.