Malicious PDF — malware analysis report

Static analysis result for SHA-256 f580e8b1b71377ef…

MALICIOUS

PDF

58.4 KB Created: 2020-09-13 22:45:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0df7cf4fbd1cffc3276cfc0cba99590a SHA-1: c47a8f416948d806f66ed348cf662800897b8bd6 SHA-256: f580e8b1b71377ef8c790c4a364562e2e6a8c6bbde115a76970c193ce515a087
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF contains a direct link to a known malicious redirector, which is further supported by heuristics indicating a malicious redirector link and a link farm. The document body, though heavily obfuscated, contains the text 'Roblox exploit gui template' and the malicious URL, suggesting a lure to a site offering exploit templates. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/wix?keyword=roblox+exploit+gui+template
    • http://files.newworldexploration.com/uploads/1/3/1/3/131380024/josemipinunufo.pdf
    • http://bibox.uintapreparations.com/uploads/1/3/1/6/131637649/fc6e4.pdf
    • http://vixan.deborahbrosnan.com/uploads/1/3/0/9/130969341/zovejifafozal-zivax-jupiw.pdf
    • http://files.herrandassociates.greatwebsitebuilder.com/uploads/1/3/2/6/132683181/soraxikafojipo-moparimuludur-vapasivotu-japikujej.pdf
    • http://files.woodstockvolleyball.com/uploads/1/3/1/3/131379894/6155913.pdf
    • https://static.usrfiles.com/ugd/140efa_03e376c976974b55a1bc5b890d66acb3.pdf
    • https://static.usrfiles.com/ugd/66c878_da39c3c9624c44959dd335b34172d1e6.pdf
    • https://static.usrfiles.com/ugd/6f7357_f3eb473a67cb44639fa46d977a88d987.pdf
    • https://static.usrfiles.com/ugd/724bd4_fbeec59970a04a0dbe4f5e2916190c12.pdf
    • https://static.usrfiles.com/ugd/b5aed9_b4185f88b79b4e1185b0474c24753c88.pdf
    • https://static.usrfiles.com/ugd/a42eed_add4dcbf4a7b4da8b2dd59bb98c355b2.pdf
    • https://static.usrfiles.com/ugd/05e3ad_fb5964e3127448338f93e16422fab161.pdf
    • https://static.usrfiles.com/ugd/3ed44c_518c1360dab24552b605d643329a2ffe.pdf
    • https://static.usrfiles.com/ugd/05301a_7394ccf256bc4d5d8b8863008e144498.pdf
    • https://static.usrfiles.com/ugd/97634b_41a10431cdd24a2c8ad4c8a995404a46.pdf
    • https://static.usrfiles.com/ugd/54dfea_c98aea6866f54ed98b5abe13466466b3.pdf
    • https://static.usrfiles.com/ugd/4d400c_26cab9b117574efea1df2cf8706ca1d1.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008be2.bin
67336e85e3afba3ddb01e92e6fdcec33145e29a20fb493c936dece39be34c7f6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8BE2 4856 bytes
font_01_sfnt_off00009c7e.bin
28ea6bdc8321a7508fec4d2df7b59b5c80a704123cf556c7e9fc5f5f21055d0c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9C7E 16200 bytes
font_02_sfnt_off0000ce82.bin
9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCE82 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.