Malicious PDF — malware analysis report

Static analysis result for SHA-256 fad8e925cf1ee2d9…

MALICIOUS

PDF

38.7 KB Created: 2020-08-16 22:39:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e3e37b600baf7026885ba3ef90c493b5 SHA-1: eb9a3faee757d9d87a9098d5ded24b5dbbe91d7e SHA-256: fad8e925cf1ee2d9ba515a3edf04a0eec4deb5da451c86d853cac9b645b4d1da
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF contains embedded links that lead to a redirector infrastructure, identified by the 'PDF_MALICIOUS_REDIRECTOR_LINK' heuristic. The document body, though heavily obfuscated, contains text that appears to be a lure for a movie download, suggesting a social engineering tactic. The presence of numerous external links, as noted by 'PDF_SEO_LINK_FARM', further supports the malicious intent of directing users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9972

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=anuraga+karikkin+vellam+full+movie++free
    • http://files.horn-pond.org/uploads/1/3/1/4/131455475/8b7a8ce317a7.pdf
    • http://files.rootstoharvest.org/uploads/1/3/1/6/131606672/kaxun.pdf
    • http://vasor.churchweddingspaphos.com/uploads/1/3/0/7/130775403/nadisuxufakev.pdf
    • https://cdn.shopify.com/s/files/1/0434/3182/1468/files/subcontractor_warranty_letter_template.pdf
    • https://cdn.shopify.com/s/files/1/0437/0730/2037/files/12031126370.pdf
    • https://cdn.shopify.com/s/files/1/0431/2937/2832/files/36044005222.pdf
    • https://cdn.shopify.com/s/files/1/0432/6172/2788/files/ansys_hfss.pdf
    • https://cdn.shopify.com/s/files/1/0430/6229/6725/files/4242449599.pdf
    • https://cdn.shopify.com/s/files/1/0436/2806/9017/files/rrb_alp_cbt_2_syllabus.pdf
    • https://cdn.shopify.com/s/files/1/0446/6235/8179/files/ejercicios_de_enlaces_ionicos_resueltos.pdf
    • https://cdn.shopify.com/s/files/1/0437/6671/0426/files/kemuroz.pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000062b3.bin
7a942fe3b920985002b9136453df608a58648c250142908fdbbe03732ce00fc1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x62B3 5024 bytes
font_01_sfnt_off000073bd.bin
6dd85ba557eac9ed16bfb9fdfed9aec4caa96cc01c4a8988be4ccd9733adc9d9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x73BD 10568 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.