Malicious PDF — malware analysis report

Static analysis result for SHA-256 0a75cd0c657c2545…

MALICIOUS

PDF

39.6 KB Created: 2020-08-19 22:52:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 46f34be928d6c24f51183b006fe81dff SHA-1: c7e1ae92e38efad6a67cad643906bc688651d570 SHA-256: 0a75cd0c657c25459a4289da065a7c74e40f62bb62e09c4a0fc48dbddbd1374d
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links, with a critical heuristic firing for PDF_SEO_LINK_FARM and PDF_MALICIOUS_REDIRECTOR_LINK. The primary malicious URL identified is https://ttraff.ru/pify?keyword=businessman+sir+osthara+video+song, which is likely used for SEO poisoning or to redirect users to phishing sites. While no scripts were extracted, the structure and embedded links suggest an attempt to drive traffic to malicious infrastructure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=businessman+sir+osthara+video+song
    • http://files.natureworld.com.au/uploads/1/3/0/9/130969965/59695dfd29f25.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://cdn.shopify.com/s/files/1/0435/1374/1471/files/care1st_prior_authorization_form_san_diego.pdf
    • https://cdn.shopify.com/s/files/1/0431/4356/1376/files/dotixarejuxazavuliti.pdf
    • https://cdn.shopify.com/s/files/1/0445/3256/4132/files/31521303511.pdf
    • https://cdn.shopify.com/s/files/1/0432/4913/9880/files/12688513189.pdf
    • https://cdn.shopify.com/s/files/1/0437/7955/5486/files/79971825589.pdf
    • https://cdn.shopify.com/s/files/1/0433/9168/0673/files/dawoodi_bohra_marsiya_book.pdf
    • https://cdn.shopify.com/s/files/1/0430/3293/6605/files/36394511905.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/32732230761.pdf
    • https://cdn.shopify.com/s/files/1/0430/5757/8137/files/49964418464.pdf
    • https://cdn.shopify.com/s/files/1/0436/0326/3645/files/bemutosafawutalivuwibog.pdf
    • https://cdn.shopify.com/s/files/1/0428/2341/8019/files/vegese.pdf
    • https://cdn.shopify.com/s/files/1/0453/1814/4155/files/39153444079.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000046a6.bin
7073ee5bdb5dd741069b335d75c59d29e66e5f2c28e3f98ac83aea32ad5521b8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x46A6 5196 bytes
font_01_sfnt_off0000581f.bin
e23dadcc063377cc6b338ff215733ca637bf85fcc7a1df7f03058fed835665b8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x581F 13916 bytes
font_02_sfnt_off0000837b.bin
ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x837B 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.