Malicious PDF — malware analysis report

Static analysis result for SHA-256 181a8373f558c131…

MALICIOUS

PDF

77.1 KB Created: 2020-08-22 18:51:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a684076d79b7a99ec745b8d8eaf676d9 SHA-1: ddfd33dae54de4fd2ea9dc38f5656521db70b872 SHA-256: 181a8373f558c13196fe163911a97cc4e85c2026e7b7eab463a3168bcef5f7e0
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links, many pointing to PDF files hosted on Shopify, suggesting an attempt at SEO poisoning or link farming. One critical heuristic identified a link to a known malicious redirector at 'https://ttraff.com/pify?keyword=define+chimerical+form', indicating a phishing or malware distribution attempt. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9966

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=define+chimerical+form
    • http://files.thisiselva.com/uploads/1/3/1/3/131378771/3ce826.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fedorahosted.org/lohit
    • http://www.opentle.org
    • https://cdn.shopify.com/s/files/1/0438/5007/2214/files/kindle_book_cover_template_psd.pdf
    • https://cdn.shopify.com/s/files/1/0431/0378/1015/files/clinical_pharmacy_and_therapeutics_fifth_edition.pdf
    • https://cdn.shopify.com/s/files/1/0428/7463/4403/files/apache_ignite_book.pdf
    • https://cdn.shopify.com/s/files/1/0434/6265/6157/files/30658596508.pdf
    • https://cdn.shopify.com/s/files/1/0430/9418/0001/files/shaun_t_cize_videos.pdf
    • https://cdn.shopify.com/s/files/1/0432/5448/1058/files/towifikeruwev.pdf
    • https://cdn.shopify.com/s/files/1/0431/9579/3557/files/angeles_y_demonios_espaol.pdf
    • https://cdn.shopify.com/s/files/1/0432/8210/4478/files/molixalejamidomukupin.pdf
    • https://cdn.shopify.com/s/files/1/0440/4353/4486/files/bupisabu.pdf
    • https://cdn.shopify.com/s/files/1/0430/6278/8245/files/baking_sheet_pizza_stone.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://scripts.sil.org/OFL
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNU
    • http://www.gnu.org/copyleft/gpl.htmRegular
    • http://www.gnu.org/licenses/gpl.html

Extracted artifacts 10

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_011_off0000f65b.bin
58b729e71f3b17f44293fe62ce6bcfc34b95a5f68d731d13b3644de452554fc4		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xF65B 18632 bytes
font_00_sfnt_off00005ef0.bin
18d1a7bb516f4e0beb50e527c38eb3af28a0ef941a7375a054a274d06c7a5c91		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5EF0 7240 bytes
font_01_sfnt_off000077c8.bin
4575e0e9c6badeddd07fd9c26b6ac5ba53aa8fe621f4fd63aafc95e631e3ef86		 pdf-font-stream PDF embedded font (sfnt) at offset 0x77C8 4940 bytes
font_02_sfnt_off00008864.bin
c64067c168cc6b9e74397ca3c6475eefa138a569a4333d15ce9cf3d0a3b9c2b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8864 3720 bytes
font_03_sfnt_off0000961f.bin
36590ba527aef0bf4f62b042de78fb1248709956f4cc6798144256c90730be69		 pdf-font-stream PDF embedded font (sfnt) at offset 0x961F 4388 bytes
font_04_sfnt_off0000a437.bin
6d897259d7ab9db79b0dbb16904cd99ff486aa7f4a475590a5d3e44eab6e0eed		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA437 2328 bytes
font_05_sfnt_off0000aeed.bin
b3976ad28991401f3a7e0d936621f3963ed8fd81aff5bedc9e25cf6548b1959b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAEED 2108 bytes
font_06_sfnt_off0000b8b8.bin
c8cb303e765c67f43d6d34f29c1d02953890772ff7b697be779fb29335000f72		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB8B8 6640 bytes
font_07_sfnt_off0000ca57.bin
92d90baf06fd616c97e30092bdc8d28e83745055d4f058487160a880826a14b0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCA57 13408 bytes
font_09_sfnt_off000114cb.bin
a7d7e9034f34796b534efbd025fe3adde6db3e033495b810d3fc00d4c4836b46		 pdf-font-stream PDF embedded font (sfnt) at offset 0x114CB 4240 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.