Malicious PDF — malware analysis report

Static analysis result for SHA-256 ef35eeb47032695d…

MALICIOUS

PDF

37.3 KB Created: 2020-08-29 03:53:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f122112b9f427fe0ba015202a69d1767 SHA-1: 2e790edb473d4601d9515e3eac7d4c82891e7551 SHA-256: ef35eeb47032695d3824e7671ecedae40690807edbf8326ce95fe1656607c1f3
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged as malicious by a machine learning classifier and contains a critical heuristic indicating it links to known malicious redirector infrastructure. The document body, though heavily obfuscated, contains the primary malicious URL. The presence of a large number of external PDF links, many pointing to the same dominant host, suggests a link farm used to obscure the ultimate malicious destination or for SEO poisoning.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=the+eleventh+plague+quotes+and+page
    • https://static.usrfiles.com/ugd/b8c837_76517ad3aae0491997d8781ec65862e6.pdf
    • https://static.usrfiles.com/ugd/b8c837_7cc1ff8c49264674aebd911e5a5f93b6.pdf
    • https://static.usrfiles.com/ugd/b8c837_5eed99d82ee74410ab42ccda4f97eaf5.pdf
    • https://static.usrfiles.com/ugd/b8c837_3145514fadbc403c980e1205c7af80c7.pdf
    • https://cdn.shopify.com/s/files/1/0460/2032/9631/files/agrobacterium_transformation_protocol_arabidopsis.pdf
    • https://cdn.shopify.com/s/files/1/0432/9888/1704/files/19087555591.pdf
    • https://cdn.shopify.com/s/files/1/0433/4003/8302/files/tudasomumelogakeketi.pdf
    • https://cdn.shopify.com/s/files/1/0435/3890/7288/files/27488338232.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/velokiw.pdf
    • https://static.usrfiles.com/ugd/b8c837_3bd5f229bb2d4ace8ce9d91a1189196a.pdf
    • https://static.usrfiles.com/ugd/b8c837_b65b6b364e914b7688130d7141cae64d.pdf
    • https://static.usrfiles.com/ugd/b8c837_3a4ea0cd60014030b103700e0c3e7d7e.pdf
    • https://static.usrfiles.com/ugd/b8c837_7f08fad810a54e01839bdafd1b2ee5ad.pdf
    • https://static.usrfiles.com/ugd/b8c837_d4bc63aec21f4fd298cdbf2dfe644ee0.pdf
    • https://static.usrfiles.com/ugd/b8c837_23a055ba82364faa9aee6e7df11a00e8.pdf
    • https://static.usrfiles.com/ugd/b8c837_7331cb75466f4d14ab4eec207a33c1d8.pdf
    • https://static.usrfiles.com/ugd/b8c837_fe8f302857a94cf19bec3f85718177bb.pdf
    • https://static.usrfiles.com/ugd/b8c837_179928909eac40b2b6fdd4043b1e727b.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000054f5.bin
e9fcb6eeae5970267528cb95396b9eade9b91ff471faa91ee6064de09ec0c031		 pdf-font-stream PDF embedded font (sfnt) at offset 0x54F5 5260 bytes
font_01_sfnt_off000066ce.bin
bf3fe05e57abef295697704fa223f6c5edb02d61fbdf270c1ace6f892e78dfb3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x66CE 9908 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.