Malicious PDF — malware analysis report

Static analysis result for SHA-256 20503bf6abe75b86…

MALICIOUS

PDF

34.3 KB Created: 2020-08-20 23:19:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2bfea44452249114a59548213bd181a9 SHA-1: a0b9f606724a390ee3ac59adc741d08187b4f73f SHA-256: 20503bf6abe75b8602c45cc4030d436524c13a59d3fbc9f773f077169c5e7309
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains multiple embedded links, with one specifically pointing to a known malicious redirector. The document body, though heavily obfuscated, includes the URL 'https://ttraff.com/pify?keyword=musica+mariah+carey+without+you', suggesting a lure to external malicious content. The presence of numerous PDF links, many hosted on Shopify, indicates a link farm strategy, likely to obscure the ultimate destination or to improve search engine visibility for malicious content. The ML classifier strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=musica+mariah+carey+without+you
    • http://faliroxa.elkdalebaptist.com/uploads/1/3/1/3/131384714/7787845.pdf
    • http://valubizuv.mrsbassmath.com/uploads/1/3/0/8/130874050/wibakarumozut_jarixezesi_zarose_jutazudizimala.pdf
    • http://wosujaker.americancollegeofspinesurgery.org/uploads/1/3/1/4/131455463/muwaninewegi.pdf
    • https://cdn.shopify.com/s/files/1/0436/0699/9203/files/83526542107.pdf
    • https://cdn.shopify.com/s/files/1/0433/1179/2286/files/oxford_dictionary_of_physics_download.pdf
    • https://cdn.shopify.com/s/files/1/0435/4464/1695/files/polarized_test_image.pdf
    • https://cdn.shopify.com/s/files/1/0428/6647/5174/files/53242126734.pdf
    • https://cdn.shopify.com/s/files/1/0428/8810/2051/files/expression_of_interest_letter_template_project.pdf
    • https://cdn.shopify.com/s/files/1/0435/2606/2239/files/setumiligetuwopazawog.pdf
    • https://cdn.shopify.com/s/files/1/0429/6481/1935/files/4419326844.pdf
    • https://cdn.shopify.com/s/files/1/0431/0201/1548/files/lavixobutapubadikika.pdf
    • https://cdn.shopify.com/s/files/1/0437/8735/4270/files/bollywood_upcoming_movies_trailer.pdf
    • https://cdn.shopify.com/s/files/1/0432/6916/1110/files/gupawa.pdf
    • https://cdn.shopify.com/s/files/1/0427/9874/3719/files/the_oxford_handbook_of_functional_data_analysis.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004905.bin
aad825a803c706dfff84e850cecd50243b8d3fc97ce8178da4c4e0d583c76084		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4905 5208 bytes
font_01_sfnt_off00005aae.bin
3bd57af1366ebc47c17ed07bf734a303b90a53dc082418e7c09effd8790185ed		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5AAE 10072 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.