Malicious PDF — malware analysis report

Static analysis result for SHA-256 10cd15431e090d60…

MALICIOUS

PDF

42.9 KB Created: 2020-08-15 13:21:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d5c4aed4888b378b3f87f14126479db0 SHA-1: aa3a50f137ef4f710c9582e2ede05a9247fb1efe SHA-256: 10cd15431e090d60c2e3cb7efb16b8871f3259884158e6c7c38e1302f39a816e
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links, many pointing to external PDF files, suggesting a link farm or SEO spam operation. One prominent link, https://ttraff.com/wb?keyword=crushing%20by%20td%20jakes%20pdf%20download, is flagged as a malicious redirector. The document body, though partially corrupted, contains text related to a book download and the malicious URL, indicating a lure to drive traffic to malicious infrastructure. No scripts were extracted, but the presence of numerous links and the malicious redirector strongly suggest a malicious intent to redirect users to harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wb?keyword=crushing%20by%20td%20jakes%20pdf%20download
    • http://files.nhbea.com/uploads/1/3/0/8/130813888/a5ec2.pdf
    • http://files.americancollegeofspinesurgery.org/uploads/1/3/0/9/130968947/4980196.pdf
    • http://files.oilsetc.com/uploads/1/3/1/3/131383838/2b6b4591a499.pdf
    • http://files.elizabethmackie.com/uploads/1/3/0/8/130813521/rezebusorurigub_wumovokiwij_jareva.pdf
    • http://files.thehealingplacecg.com/uploads/1/3/1/4/131437605/konubigajenuf.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/gigogew.pdf
    • https://cdn.shopify.com/s/files/1/0450/8601/5640/files/split_merge_files_online.pdf
    • https://cdn.shopify.com/s/files/1/0432/0333/0208/files/arjun_reddy_breakup_song_lyrics.pdf
    • https://cdn.shopify.com/s/files/1/0429/8987/9445/files/xebinabuladipujej.pdf
    • https://cdn.shopify.com/s/files/1/0428/0093/9164/files/nivoxizob.pdf
    • https://cdn.shopify.com/s/files/1/0432/7617/3472/files/jegajasenibalofixiwifesuk.pdf
    • https://cdn.shopify.com/s/files/1/0432/9875/0619/files/49660013337.pdf
    • https://cdn.shopify.com/s/files/1/0436/2931/4206/files/zafif.pdf
    • https://cdn.shopify.com/s/files/1/0433/4950/8246/files/12858074139.pdf
    • https://cdn.shopify.com/s/files/1/0427/6987/5111/files/57699009325.pdf
    • https://cdn.shopify.com/s/files/1/0437/4921/2309/files/99101115736.pdf
    • https://cdn.shopify.com/s/files/1/0429/2729/2582/files/juxifokeregarubulogutevom.pdf
    • https://cdn.shopify.com/s/files/1/0438/1474/8322/files/95607368406.pdf
    • https://cdn.shopify.com/s/files/1/0436/4589/4816/files/cambridge_igcse_biology_workbook_second_edition_answers.pdf
    • https://cdn.shopify.com/s/files/1/0433/8368/5270/files/38167643483.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005cdf.bin
5609b24cd8f92340777572152cc5146608620d1a183d3dd1537ef13023b815c3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5CDF 5680 bytes
font_01_sfnt_off00007042.bin
f9ebc8c46d30b2f702c9c7239ce83f43649a35fdd55f2047858d40c4ec5c7b6b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7042 14964 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.