Malicious PDF — malware analysis report

Static analysis result for SHA-256 f8277e24fb2d1723…

MALICIOUS

PDF

55.6 KB Created: 2020-08-10 00:41:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-29
MD5: 4c01b474700ff106a96c77e2fae1d49e SHA-1: 7792a5a5c4054466109bc33e8f8ee7021b08437e SHA-256: f8277e24fb2d1723db215bb5587303ef164be06e6baf28bdee89b37deca44cc2
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded links, including one pointing to known malicious redirector infrastructure. The document body, though obfuscated, contains text related to 'headway elementary fourth edition tests pdf' and the malicious URL, suggesting a lure to download further content. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=headway+elementary+fourth+edition+tests+pdf In PDF document text
    • http://jufuli.mediumsarahlemos.com/uploads/1/3/1/4/131453645/48821765c5bc2.pdfIn PDF document text
    • http://files.pbhomephysio.ca/uploads/1/3/1/0/131070207/154db1.pdfIn PDF document text
    • http://luwaleb.small2big.co.uk/uploads/1/3/1/8/131856158/76de946b2a.pdfIn PDF document text
    • http://xakaledos.dorsettrailtourismassociation.com/uploads/1/3/0/7/130776485/vuzufedumezixifim.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://cdn.shopify.com/s/files/1/0434/2336/7335/files/00000_zip_code.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0428/6559/0438/files/pudofujavonu.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0431/8491/4583/files/gomatajonagekirizoj.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0432/1129/2829/files/tonufireb.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0428/1214/5823/files/66805070523.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0433/6546/6270/files/aptitude_test_with_answers_for_it_companies.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0437/3810/3962/files/wibokazidenivudi.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0432/7243/7910/files/nupipujetisedofo.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0443/3425/2188/files/6950471408.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0431/4251/2791/files/7374512998.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0434/6835/7796/files/mixuzejemofukajive.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000086a5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x86A5 5436 bytes
SHA-256: 12e18f109fa6cc07d430e7e0f3e40b74481e92288bea5f1dd6f88377ab073c7d
font_01_sfnt_off0000990f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x990F 17676 bytes
SHA-256: 5141adadaaf31c48fb3d7df67cd17841b3e9cefc067e03abb13b6b330256c9ec

Open this report in the interactive analyzer, or submit your own file for analysis.