Malicious PDF — malware analysis report

Static analysis result for SHA-256 09d60ce9f21d4328…

MALICIOUS

PDF

33.0 KB Created: 2020-08-22 03:29:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f8c085ca898d83fd308074f4b16d961d SHA-1: 316f7054f6fd37e4202d64fd993f31fbc25713ac SHA-256: 09d60ce9f21d432813682387bf0033a0998c13b1ae7f77afac9ab57d1a42731d
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a link farm designed to redirect users to malicious infrastructure, specifically identified by the heuristic PDF_MALICIOUS_REDIRECTOR_LINK. The document body, though heavily obfuscated, contains the URL https://ttraff.com/pify?keyword=i+dreamed+a+dream+piano+sheet+pdf, which is likely intended to trick users into downloading further malicious content. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=i+dreamed+a+dream+piano+sheet+pdf
    • http://pibifapu.eldritchvintage.co.uk/uploads/1/3/0/7/130776644/gejezaga-tilixunofus-dejenotaf.pdf
    • http://tapim.cementfab.com/uploads/1/3/0/7/130775376/4792952.pdf
    • http://zeluvote.thepeoplesbookkeeper.ca/uploads/1/3/0/7/130776672/kixenomowuzag_boliwe_losufali.pdf
    • http://simobiz.focusfivedesigns.com/uploads/1/3/1/4/131437987/zoxanujoxumebe-vopibaruku-xawavubiziwup-jotizeziko.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0435/7799/9519/files/holt_english_textbook_9th_grade.pdf
    • https://cdn.shopify.com/s/files/1/0451/1550/6853/files/99925380607.pdf
    • https://cdn.shopify.com/s/files/1/0429/6740/0601/files/gunobodi.pdf
    • https://cdn.shopify.com/s/files/1/0427/8580/0358/files/78650841932.pdf
    • https://cdn.shopify.com/s/files/1/0433/2378/5370/files/aaron_beck_cognitive_behavioral_therapy.pdf
    • https://cdn.shopify.com/s/files/1/0427/9602/3975/files/carbomastic_15_lt_data_sheet.pdf
    • https://cdn.shopify.com/s/files/1/0428/9839/1196/files/zatowusadurifuzibal.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/81603963226.pdf
    • https://cdn.shopify.com/s/files/1/0431/4651/0504/files/39707242069.pdf
    • https://cdn.shopify.com/s/files/1/0437/7303/4657/files/bizil.pdf
    • https://cdn.shopify.com/s/files/1/0432/5369/4626/files/solid_waste_management_thesis_philippines.pdf
    • https://cdn.shopify.com/s/files/1/0431/3651/6250/files/67385979766.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004527.bin
49adf3f80f903303bba773b5e9fc734bb2b3dbed6f242dd2fc74682caefd05cf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4527 5188 bytes
font_01_sfnt_off00005695.bin
03cb6325ade38e8342db27614a36f5976d55ca2c209ff85200ae61a8b3a68f2a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5695 9560 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.