Malicious PDF — malware analysis report

Static analysis result for SHA-256 e56c11cdfd209314…

MALICIOUS

PDF

76.5 KB Created: 2020-06-08 23:22:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9e479da84d3f7a693d1234bb34e89969 SHA-1: 44dfbddd2bfd3a70384104945e56eccf8f8da040 SHA-256: e56c11cdfd2093144174a4f77c33e712c3b0fec2f37f6f83aa69b347a07ddc97
234 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous links to external PDFs, many of which are algorithmically generated and point to known malicious redirector infrastructure. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' suggests the document may be instructing the user to open a password-protected archive, a common tactic to bypass gateway scanning. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 6

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wp3?keyword=liste+commande+linux+pdf#liste+commande+linux+pdf
    • http://hostalgracielaoruro.com/uploads/1/3/0/9/130968926/9035090.pdf
    • http://alpha777.net/uploads/1/3/0/5/130539645/jowel_digofaputubapo_tirapubotidif.pdf
    • http://kathrynknecht.com/uploads/1/3/0/6/130640182/ead697611d52.pdf
    • http://ourcreatorsword.com/uploads/1/3/0/8/130874067/vulolape.pdf
    • http://evejeanetteblohm.com/uploads/1/3/1/4/131437648/3976718.pdf
    • http://smartacademicediting.com/uploads/1/3/0/5/130589121/zexabiwewikimuta.pdf
    • http://realestatecareerjacksonvillenc.com/uploads/1/3/1/4/131405948/db0905a809c4b8.pdf
    • http://bomontgonyboys.com/uploads/1/3/0/7/130776519/bopoperepiparovijega.pdf
    • http://endurancebrasil.com/uploads/1/3/1/4/131453853/2431095.pdf
    • http://intentionallife.org/uploads/1/3/0/5/130588633/tegegoloxepixef-palujilu.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://kisodexogibi.files.wordpress.com/2020/06/wimikabis.pdf
    • https://tepofateg.files.wordpress.com/2020/06/wisosorovegizukegun.pdf
    • https://vabikenubo.files.wordpress.com/2020/06/simemotisapagekatedajo.pdf
    • https://miloxeraf.files.wordpress.com/2020/06/88176493441.pdf
    • https://ruxurogizipo.files.wordpress.com/2020/06/53115770712.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f721.bin
cf26e0345e71d513c8912747edc2cadf050e0d168d7db526b5bf20528abf4e65		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF721 14412 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.