Malicious PDF — malware analysis report

Static analysis result for SHA-256 f639d245dcd5e598…

MALICIOUS

PDF

41.9 KB Created: 2020-09-07 01:16:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: 3d78ac6e95aa9626443886a8f665e230 SHA-1: 33f571e90cfc4c511658f98f9e95e78610820f37 SHA-256: f639d245dcd5e5984f3f39d2b9ac577ca4e4aafcee4ab3adb92433737122211a
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains embedded links that are designed to redirect users to malicious websites, as indicated by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The document body, though partially corrupted, suggests a lure related to flooring installation guides. The presence of numerous external PDF links, many pointing to Shopify, indicates a link farm strategy. While no scripts were explicitly extracted, the PDF structure and embedded links are indicative of a phishing or redirection attack.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=laminate+flooring+installation+guide+pdf In PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://cdn.shopify.com/s/files/1/0433/1778/8830/files/short_reading_comprehension_passages_with_answers.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0433/1870/6341/files/pefobifexixuxo.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0436/5841/2185/files/php_generate_from_html.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/ace02d_8ef70246e2a5424cb2eed973a8e932eb.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/3aee12_cbb35317224c415fb97b269df6f7d6f5.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/b8c837_fcd4a41a79af447bb24ddede2b7f64e0.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/cc089a_8645a7eee9704c389da2c7d8235385db.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/47e66e_86c62a6006ae4a53ba3631a19ca2df0c.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/cfbfd2_aec250eb07824c0599152db63e835f3b.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/0e2875_cfc59933f5a849af97a108a403140291.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/738632_a2cf2bec33c04d668b62af979e5c7d48.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/838e7e_49bf93ba484f45b2b982f1001a5063ad.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/6dcf04_4e53cf24f5f64c41abd221181dc9a57e.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/eda9ba_3f10fa44560043fead9ec33f3544b716.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000065c5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x65C5 5300 bytes
SHA-256: 3cf00efa13ca441ef4037d35e60eb8004037da1b84059fb33fa7048e95fdcc50
font_01_sfnt_off000077c0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x77C0 10200 bytes
SHA-256: ce441d5e69711ba58aa81cc9be728e9ffbb968d29de82f43c2e3499405250dd6

Open this report in the interactive analyzer, or submit your own file for analysis.