Malicious PDF — malware analysis report

Static analysis result for SHA-256 ec833043bee242a1…

MALICIOUS

PDF

52.0 KB Created: 2020-08-29 22:44:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2930b5a6af9e79b248c3568e626a1d08 SHA-1: ae0e8608fcbd6e34be8718318327e131c5dc42f2 SHA-256: ec833043bee242a14ea53909ae5bb480f78e77f33a49d4abd7e17795561ba29e
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains embedded links that redirect to a malicious domain, identified by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The document body, though partially corrupted, suggests a lure related to learning French, which is then used to mask the malicious redirection. The ML_NYX_PDF_MALICIOUS classifier strongly supports the malicious nature of this PDF. The primary IOC is the redirector URL.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=livre+pour+apprendre+le+fran%25C3%25A7ais+pdf
    • https://cdn.shopify.com/s/files/1/0435/2750/4024/files/dowosemukezaxipoduwuwuf.pdf
    • https://cdn.shopify.com/s/files/1/0434/9201/6280/files/tibufefibiborakipeka.pdf
    • https://cdn.shopify.com/s/files/1/0429/4960/7590/files/72020774356.pdf
    • https://cdn.shopify.com/s/files/1/0431/8674/9604/files/remstar_m_series_manual.pdf
    • https://cdn.shopify.com/s/files/1/0431/0843/4077/files/48929762385.pdf
    • https://cdn.shopify.com/s/files/1/0434/6275/4461/files/41014660317.pdf
    • https://static.usrfiles.com/ugd/b7082a_296b2fb2bb5e496baaa37abae07fc8d8.pdf
    • https://static.usrfiles.com/ugd/ce0e6d_591c57f482e1406d9b9226f41eda7be0.pdf
    • https://static.usrfiles.com/ugd/b8c837_7c8bc529c4e34f1496d0b4591b5addac.pdf
    • https://static.usrfiles.com/ugd/b8c837_c452ab1d71f54381abc52f0acead2ad0.pdf
    • https://static.usrfiles.com/ugd/2f3ac6_c60f68c89147435db6964cab5e8a9da8.pdf
    • https://static.usrfiles.com/ugd/b8c837_c35bd179ac7a4036a742c1aa8f7f46b5.pdf
    • https://static.usrfiles.com/ugd/b8c837_701b8985ac11465f8bac312c70df71e6.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000065b0.bin
1425b7c3a5f3d0d933cd059fda6591bc4308aecb0822f0f164270aa0818a3dd8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x65B0 5020 bytes
font_01_sfnt_off000076cc.bin
c4e4962a814d0e15ca14648e287c790ad28a1423ba4fdbfa40e288fcb8f8d669		 pdf-font-stream PDF embedded font (sfnt) at offset 0x76CC 12084 bytes
font_02_sfnt_off00009d6d.bin
e93acd332f5893643511f4cefd38969ad5c744ad1b08842a788b6be7d277dd15		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9D6D 16204 bytes
font_03_sfnt_off0000b29b.bin
4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB29B 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.