Malicious PDF — malware analysis report

Static analysis result for SHA-256 1983856977f1f909…

MALICIOUS

PDF

44.3 KB Created: 2020-08-10 14:16:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9770ee71d06116d0f9f3c2f34b71a512 SHA-1: 0e97df39693c56157556ed4eb5138e76f7d55bc5 SHA-256: 1983856977f1f909df5c8712f6b710593918baab081bdb4c27b8e39543bbcb97
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous links, with one identified as a malicious redirector pointing to 'https://ttraff.com/pify?keyword=dr+brian+weiss+books+pdf'. The document body and embedded link structures suggest a tactic to distribute SEO-optimized PDFs, likely to drive traffic to malicious sites or host further malware. The presence of multiple Shopify links, some benign and some unknown, indicates an attempt to blend in with legitimate content while directing users to malicious infrastructure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=dr+brian+weiss+books+pdf
    • http://zopif.mastermarinelines.net/uploads/1/3/1/0/131070450/noguve.pdf
    • http://files.themortimercbs.org/uploads/1/3/0/8/130874683/5928389.pdf
    • http://files.greaterconcordinterfaithcouncil.org/uploads/1/3/1/4/131407148/goxuxodifo.pdf
    • http://files.cuctf.com/uploads/1/3/1/4/131414134/615053.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0434/2988/8161/files/46402277795.pdf
    • https://cdn.shopify.com/s/files/1/0438/0029/7633/files/jersey_future_download.pdf
    • https://cdn.shopify.com/s/files/1/0433/4351/1703/files/carb_cycling_vegan_meal_plan.pdf
    • https://cdn.shopify.com/s/files/1/0430/2821/8010/files/42425358098.pdf
    • https://cdn.shopify.com/s/files/1/0427/5650/5756/files/mekalejesusiveliselivupi.pdf
    • https://cdn.shopify.com/s/files/1/0429/1392/3228/files/andromaque_acte_1_scene_4.pdf
    • https://cdn.shopify.com/s/files/1/0428/2882/4742/files/16937224222.pdf
    • https://cdn.shopify.com/s/files/1/0431/3546/7682/files/8472679102.pdf
    • https://cdn.shopify.com/s/files/1/0427/6633/6167/files/19115344935.pdf
    • https://cdn.shopify.com/s/files/1/0437/6307/3181/files/vezakologomosexorijek.pdf
    • https://cdn.shopify.com/s/files/1/0434/8870/6717/files/ohio_bmv_locations.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000631a.bin
d0786e0fc4e5d48617e7d6fe943d93ea1f8497ea6dacd02e49341c446373889d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x631A 5296 bytes
font_01_sfnt_off0000753c.bin
6f0e326f4b3c5c9dfe9fe4f32727cad4026cf1c5d974864b1ed21ae7990adf15		 pdf-font-stream PDF embedded font (sfnt) at offset 0x753C 15192 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.