Malicious PDF — malware analysis report

Static analysis result for SHA-256 0d31949028a7380e…

MALICIOUS

PDF

310.0 KB Created: 2020-08-05 08:33:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ddd56c1187c695e9026b9499d8980cce SHA-1: 30926bd3bc8c229a0f087c3199f95683e1761aaa SHA-256: 0d31949028a7380ea4b70ebbbc3c2f20ad4930d0090a6d1c291ff4e5cbd13872
142 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF contains a link to known malicious redirector infrastructure, specifically 'https://ttraff.ru/pify?keyword=autocad+3d+pdf+plugin+free'. The document also exhibits characteristics of a remote support lure, suggesting an attempt to trick the user into installing potentially unwanted or malicious software. The ML classifier strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9953

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Remote-support tool lure high SE_REMOTE_SUPPORT_LURE
    Document instructs the user to install, open, or connect with a remote-support tool such as AnyDesk, TeamViewer, Quick Assist, or ScreenConnect — high-risk in an unsolicited document
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=autocad+3d+pdf+plugin+free
    • http://files.halswellwigramrugby.com/uploads/1/3/0/7/130775588/8218573.pdf
    • http://files.dandelionsanddaisiesfiberarts.com/uploads/1/3/0/8/130873930/xujuputofirivom.pdf
    • http://files.jazzstylez.com/uploads/1/3/0/8/130874143/812480.pdf
    • http://files.lfhdigital.com/uploads/1/3/1/4/131453493/d08acb75e.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0428/4124/3814/files/poisson_probability_distribution_table.pdf
    • https://cdn.shopify.com/s/files/1/0434/1117/7626/files/7848263877.pdf
    • https://cdn.shopify.com/s/files/1/0438/3873/4496/files/62388269468.pdf
    • https://cdn.shopify.com/s/files/1/0429/9846/4661/files/sojopomaxabibanajokuleba.pdf
    • https://cdn.shopify.com/s/files/1/0433/1828/0357/files/adjectives_and_adverbs_activities.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/telisupuf.pdf
    • https://cdn.shopify.com/s/files/1/0431/4526/5318/files/campbell_biology._7th_edition.pdf
    • https://cdn.shopify.com/s/files/1/0431/1416/8487/files/joguwonug.pdf
    • https://cdn.shopify.com/s/files/1/0429/9803/8679/files/xibikorilokinevisafupagud.pdf
    • https://cdn.shopify.com/s/files/1/0432/2479/3245/files/briggs_and_stratton_generator_manual.pdf
    • https://cdn.shopify.com/s/files/1/0436/5081/0014/files/42959259713.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/38140624907.pdf
    • https://cdn.shopify.com/s/files/1/0428/1961/6935/files/44573362516.pdf
    • https://cdn.shopify.com/s/files/1/0428/2312/3100/files/zejawo.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/48054684450.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00046b13.bin
8478d9196f7636aa75589db7bf10aaeb9a8693d3707071667f6f94fae0351e16		 pdf-font-stream PDF embedded font (sfnt) at offset 0x46B13 5296 bytes
font_01_sfnt_off00047d34.bin
da3fcdfbe1860180cd61704028fabb37dbb93862825912af4a223ae4e5e1cffe		 pdf-font-stream PDF embedded font (sfnt) at offset 0x47D34 17432 bytes
font_02_sfnt_off0004b310.bin
a95eff378c135b1ab40d10b3cd1da1bafbc07f86005f57898d079c90d712ddbd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4B310 16204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.