Malicious PDF — malware analysis report

Static analysis result for SHA-256 e9f443af9db6f2af…

MALICIOUS

PDF

43.1 KB Created: 2020-08-08 09:02:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 15be562aff195310212a28e8adf101ca SHA-1: 30f2f7db4a456cc4d06176dd61e96b6e5295a043 SHA-256: e9f443af9db6f2af81eb49477f29cdd5730a283fcd759766471a912e3098242b
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Phishing: Spearphishing Attachment T1204.002 Malicious File: Malicious Link

The PDF document contains a lure for downloading 'The Umbrella Academy comic español pdf' which redirects to a known malicious URL. The document also hosts a large number of external PDF links, suggesting a link farm for SEO manipulation or traffic redirection. No scripts were extracted, but the embedded malicious URL is the primary indicator of compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=the+umbrella+academy+comic+espa%25C3%25B1ol+pdf+descargar+gratis
    • http://files.danielkies.com/uploads/1/3/1/3/131398085/wifizazarifakomoras.pdf
    • http://milexodel.ryleyskelton.com/uploads/1/3/1/6/131606349/9216711.pdf
    • http://files.alderleyltc.com/uploads/1/3/0/7/130738841/pijitowujonim.pdf
    • https://cdn.shopify.com/s/files/1/0429/3538/6265/files/67983345217.pdf
    • https://cdn.shopify.com/s/files/1/0435/9120/5021/files/73134782566.pdf
    • https://cdn.shopify.com/s/files/1/0434/9938/9080/files/60985384475.pdf
    • https://cdn.shopify.com/s/files/1/0430/5446/5175/files/kevin_gates_satellites_lyrics.pdf
    • https://cdn.shopify.com/s/files/1/0431/5345/7320/files/jezawupabapipamawo.pdf
    • https://cdn.shopify.com/s/files/1/0439/1682/0635/files/lista_de_exercicios_de_analise_combinatoria_com_resoluo.pdf
    • https://cdn.shopify.com/s/files/1/0430/5059/8562/files/siroliguw.pdf
    • https://cdn.shopify.com/s/files/1/0428/8770/8825/files/active_english_book_1_free_download.pdf
    • https://cdn.shopify.com/s/files/1/0433/1234/9334/files/josafel.pdf
    • https://cdn.shopify.com/s/files/1/0436/4579/6512/files/jiwujonudepi.pdf
    • https://cdn.shopify.com/s/files/1/0436/3796/4960/files/badinerie_flute_bach.pdf
    • https://cdn.shopify.com/s/files/1/0434/4047/2229/files/repenanegazenosijiju.pdf
    • https://cdn.shopify.com/s/files/1/0435/2425/9992/files/sikes.pdf
    • https://cdn.shopify.com/s/files/1/0431/9825/1165/files/91279450930.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000056cb.bin
7e22709483451ab8c963afcefeaefd7b648fea2ee4f41299ae43a5e3c48b4355		 pdf-font-stream PDF embedded font (sfnt) at offset 0x56CB 5748 bytes
font_01_sfnt_off00006a29.bin
a3a62eb33f6c83f3151d063b1013b0066d6f79b7b21844ddd6d57974fcf2b53e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6A29 10936 bytes
font_02_sfnt_off00008e3e.bin
ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8E3E 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.