Malicious PDF — malware analysis report

Static analysis result for SHA-256 11c84cf1b7094580…

MALICIOUS

PDF

36.8 KB Created: 2020-08-03 04:32:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 031531e86d1e912e0928619f45fd98a5 SHA-1: 8e92df4c08f0a4779402913ef34da13b1af6cd09 SHA-256: 11c84cf1b7094580e714e0ee1ab14224feadb4518277b105eb07f1e00a652861
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous links, including one pointing to a known malicious redirector, suggesting a link farm or SEO poisoning attack. The document body, though heavily obfuscated, contains the URL https://ttraff.ru/pify?keyword=fundamentals+of+physics+solutions+manual+pdf, which is flagged as a malicious redirector. This indicates the file's primary purpose is to redirect users to malicious infrastructure, likely for further exploitation or phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=fundamentals+of+physics+solutions+manual+pdf
    • http://files.frontierfamilyfarms.com/uploads/1/3/1/4/131453252/zuwojusef.pdf
    • http://files.screvenmotorsports.com/uploads/1/3/1/3/131381237/sugibivigejomeg.pdf
    • http://files.starkvillearts.net/uploads/1/3/1/3/131398477/jeboliwuziratep_sijumujikeg.pdf
    • http://files.2skypattaya.com/uploads/1/3/2/6/132682204/82930d1a8.pdf
    • http://files.michaelabourizk.com/uploads/1/3/2/7/132740965/2996283.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0432/5857/7056/files/2639331736.pdf
    • https://cdn.shopify.com/s/files/1/0433/8450/4474/files/kanabezumufukedovepa.pdf
    • https://cdn.shopify.com/s/files/1/0433/9462/9788/files/pmbok_5th_edition_download.pdf
    • https://cdn.shopify.com/s/files/1/0432/1820/6887/files/44582174415.pdf
    • https://cdn.shopify.com/s/files/1/0431/8704/4515/files/18571870424.pdf
    • https://cdn.shopify.com/s/files/1/0430/5852/8405/files/mudoxepevaxaziwowaxunibi.pdf
    • https://cdn.shopify.com/s/files/1/0433/8017/9107/files/91774632437.pdf
    • https://cdn.shopify.com/s/files/1/0431/4162/8072/files/69467832770.pdf
    • https://cdn.shopify.com/s/files/1/0434/7956/4448/files/22339893024.pdf
    • https://cdn.shopify.com/s/files/1/0429/7526/4919/files/29049965869.pdf
    • https://cdn.shopify.com/s/files/1/0437/6385/9605/files/samsung_mtp_driver.pdf
    • https://cdn.shopify.com/s/files/1/0431/0417/4233/files/4689558039.pdf
    • https://cdn.shopify.com/s/files/1/0435/4431/4024/files/famijavarefixosevo.pdf
    • https://cdn.shopify.com/s/files/1/0432/6513/0660/files/60258764606.pdf
    • https://cdn.shopify.com/s/files/1/0433/3377/9611/files/84178759331.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000052b5.bin
bf0047df983bfa749a68309fcd406aab99484d3f68ee7693ee9dbe27ba8b83f0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x52B5 5356 bytes
font_01_sfnt_off000064d8.bin
e94b5b78357ae7a0f4a5f6c50bff7b7e75c5e4d28f16e82b73e71a737656d782		 pdf-font-stream PDF embedded font (sfnt) at offset 0x64D8 9668 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.