Malicious PDF — malware analysis report

Static analysis result for SHA-256 0d6f202c04cb0a61…

MALICIOUS

PDF

41.7 KB Created: 2020-10-22 06:13:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: a216c3a8a2eb958495ae50bb7885aa31 SHA-1: 7204e72f00b6ae2b6a3dd96de18e254f34ed31e5 SHA-256: 0d6f202c04cb0a616212478ed59540deca1ffc73d90a9a29615ac04a03b313cb
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link to a known malicious redirector, identified by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The ML classifier also strongly flagged this PDF as malicious. The embedded URL, 'https://ttraff.link/pify?keyword=swimming+goggles+lens+color+guide', is the primary indicator of malicious intent, likely serving as a lure for a phishing or malware download. No scripts were extracted, but the presence of a malicious link is sufficient evidence.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/pify?keyword=swimming+goggles+lens+color+guide In PDF document text
    • https://mamunazeve.weebly.com/uploads/1/3/0/8/130814121/gofigunegalubiw.pdfIn PDF document text
    • https://winomumamo.weebly.com/uploads/1/3/1/0/131070375/6019285.pdfIn PDF document text
    • https://babinekisifuve.weebly.com/uploads/1/3/2/6/132696104/1782758.pdfIn PDF document text
    • https://ditiwudo.weebly.com/uploads/1/3/1/4/131452947/0d39061d8cce.pdfIn PDF document text
    • https://zalopajozi.weebly.com/uploads/1/3/1/4/131453352/c95a3f3c7.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369506/normal_5f88954b1dfb8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367302/normal_5f8f42aa07d4d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4375694/normal_5f8e270014286.pdfIn PDF document text
    • https://jovikuveditowe.weebly.com/uploads/1/3/0/8/130874612/9320316.pdfIn PDF document text
    • https://dopuxaponaxu.weebly.com/uploads/1/3/2/6/132695391/gusirapadotosixa.pdfIn PDF document text
    • https://jiwadurator.weebly.com/uploads/1/3/0/7/130776405/8107776.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366022/normal_5f86fe716c99c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4391008/normal_5f903e06db155.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370072/normal_5f90a33983049.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366031/normal_5f8701d9643cd.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/gupuso/demanda_de_amparo_directo_en_materia_laboral.pdfIn PDF document text
    • https://s3.amazonaws.com/kavitokolezub/jozivelosariva.pdfIn PDF document text
    • https://s3.amazonaws.com/kavitokolezub/phonology_definition.pdfIn PDF document text
    • https://s3.amazonaws.com/pazifetanegapu/47531779748.pdfIn PDF document text
    • https://s3.amazonaws.com/tetazino/43943936408.pdfIn PDF document text
    • https://s3.amazonaws.com/gupuso/wuxiza.pdfIn PDF document text
    • https://s3.amazonaws.com/vixuwogetiv/dolagudebu.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006460.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6460 5244 bytes
SHA-256: 5b7925ebaa534b656e5b18d804cd2ae265f54271fc972a3a7321afde8d42f8f2
font_01_sfnt_off00007627.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7627 10292 bytes
SHA-256: 9e32f00eee7a16ee65c54fe9690d1ef8d7a8cee6600c13a720e1dae0d453f00c

Open this report in the interactive analyzer, or submit your own file for analysis.