Malicious PDF — malware analysis report

Static analysis result for SHA-256 1963f198a1c9a7bd…

MALICIOUS

PDF

151.9 KB Created: 2020-08-16 16:19:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 07071e8f5b02d63da2576197a027f389 SHA-1: 44825ae8461598c4672947bc4623e8c1b8acb9bf SHA-256: 1963f198a1c9a7bd1b15e21a63af9a602fdc11da9deeecaf097d9617e9ec647d
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing indicating it links to known malicious redirector infrastructure. The embedded URL, https://ttraff.com/pify?keyword=english+phonetic+alphabet+pdf, is identified as a malicious redirector. The ML classifier also strongly flagged this PDF as malicious. The document body, though heavily obfuscated, appears to contain the malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=english+phonetic+alphabet+pdf
    • http://files.seer-gallery.com/uploads/1/3/1/1/131163949/xezagite_moragawepo.pdf
    • http://suzuru.engforu.com/uploads/1/3/2/7/132712207/gigojawefuvise.pdf
    • http://files.schaefernursery.com/uploads/1/3/1/8/131872273/fubavo_woros.pdf
    • http://zawuji.lauragrace.org/uploads/1/3/0/7/130776659/rirad-dosutivilewus-lureguke.pdf
    • http://kesedep.trinityfaithchurchtfc.org/uploads/1/3/1/3/131378950/jazegulagirexera.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0446/3860/1379/files/canales_de_distribucion_definicion.pdf
    • https://cdn.shopify.com/s/files/1/0427/9717/0847/files/marchantia_reproduction.pdf
    • https://cdn.shopify.com/s/files/1/0431/6646/6202/files/28714304647.pdf
    • https://cdn.shopify.com/s/files/1/0433/2670/1723/files/zisidunalibedevir.pdf
    • https://cdn.shopify.com/s/files/1/0427/8022/9791/files/brian_tracy_maximum_achievement_download.pdf
    • https://cdn.shopify.com/s/files/1/0431/1344/7584/files/kanenozudemisitagugopul.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/30072581460.pdf
    • https://cdn.shopify.com/s/files/1/0432/4042/3587/files/69027678955.pdf
    • https://cdn.shopify.com/s/files/1/0433/9410/5509/files/70091646908.pdf
    • https://cdn.shopify.com/s/files/1/0437/0500/8280/files/vutobaxa.pdf
    • https://cdn.shopify.com/s/files/1/0438/4548/4706/files/zelinafofos.pdf
    • https://cdn.shopify.com/s/files/1/0429/6641/7571/files/liwajojuvowapolodikenep.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00019842.bin
e25068020f732da0e938ce7ad6f95231223d91a7d874934ed1eb4017a3811032		 pdf-font-stream PDF embedded font (sfnt) at offset 0x19842 6512 bytes
font_01_sfnt_off0001a840.bin
df6155c97d9712dea8d7236f0dc15637081586cb6a3a097fcb4f8ed8f637bc03		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1A840 5420 bytes
font_02_sfnt_off0001ba9a.bin
bcad79c612290a6cbb9d662513edca982f49eb74a08c2930d0cca7b4dacd83cb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1BA9A 2300 bytes
font_03_sfnt_off0001c520.bin
889e3c79d204744e2ce6b8df51ca691b449816951014bb8ab9d09fc9f1665eda		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1C520 34864 bytes
font_04_sfnt_off000227a4.bin
b0ed233f8f551e654ba5d7d81aae6bd2b9c5895951553fddb4fba779edc34a20		 pdf-font-stream PDF embedded font (sfnt) at offset 0x227A4 17004 bytes
font_05_sfnt_off00023fc0.bin
2052824e1066c80a8989660b371703576eea3e051eb21d1777807d1ed80a8e4e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x23FC0 6240 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.