Malicious PDF — malware analysis report

Static analysis result for SHA-256 20b7abfc2bb5b38b…

MALICIOUS

PDF

59.0 KB Created: 2020-08-11 04:49:19 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 32330e7c51d429c783de07636dd9dd7d SHA-1: 17d65da3c6cf8b0108500bffccdde688f26eace5 SHA-256: 20b7abfc2bb5b38be2700804c2ebe382db88ff51d2c56c40ef98e5a1635799bb
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.cc/pify?keyword=sound+pollution+in+marathi+pdf+download'. This indicates the document is designed to lure users into clicking the link, likely to download malware or phish for credentials. The presence of a large number of external PDF links, many pointing to Shopify domains, suggests a link farm tactic to improve search engine ranking for malicious lures. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=sound+pollution+in+marathi+pdf+download
    • http://files.kmphotographyma.com/uploads/1/3/1/4/131407165/1126974.pdf
    • http://waredawom.calone.studio/uploads/1/3/1/4/131437792/c2b568.pdf
    • http://files.buffalotimberbay.org/uploads/1/3/2/6/132695755/3523257.pdf
    • http://kekan.irieiwaforstudentsinc.org/uploads/1/3/0/7/130775432/rolirixek.pdf
    • https://cdn.shopify.com/s/files/1/0430/6350/9143/files/navapowa.pdf
    • https://cdn.shopify.com/s/files/1/0431/8094/9659/files/lojefizemumoxoduzuralexux.pdf
    • https://cdn.shopify.com/s/files/1/0429/4829/6857/files/74528780960.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/gopag.pdf
    • https://cdn.shopify.com/s/files/1/0432/0906/4607/files/comunicao_no_ambiente_de_trabalho.pdf
    • https://cdn.shopify.com/s/files/1/0431/6761/3087/files/stock_market_lessons_for_beginners.pdf
    • https://cdn.shopify.com/s/files/1/0429/9957/8773/files/materialismo_filosofico.pdf
    • https://cdn.shopify.com/s/files/1/0434/9722/6402/files/wogikikebatemazug.pdf
    • https://cdn.shopify.com/s/files/1/0440/8321/6549/files/bonolota_sen_kobita.pdf
    • https://cdn.shopify.com/s/files/1/0429/9436/8663/files/nidiluzorol.pdf
    • https://cdn.shopify.com/s/files/1/0430/3775/3501/files/advocare_10_day_cleanse.pdf
    • https://cdn.shopify.com/s/files/1/0433/5425/9606/files/xapakepi.pdf
    • https://cdn.shopify.com/s/files/1/0430/4296/3613/files/48861151507.pdf
    • https://cdn.shopify.com/s/files/1/0429/7372/4825/files/google_api_design_guide.pdf
    • https://cdn.shopify.com/s/files/1/0433/3967/7855/files/43894192036.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000074fb.bin
1a26ec4e344b61fd4361a1afb8209fd503c1b19976bdbf5632d971ae3e5f8442		 pdf-font-stream PDF embedded font (sfnt) at offset 0x74FB 5296 bytes
font_01_sfnt_off000086e0.bin
d5ecec3e822993868ba70e247019bcdb656a9fee58d620eb93bc70658e929280		 pdf-font-stream PDF embedded font (sfnt) at offset 0x86E0 3720 bytes
font_02_sfnt_off00009243.bin
c7f905d4ac096010c4693810ed1309e447a6c5d98c18c4aa3e5c8523d4d9b48e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9243 10056 bytes
font_03_sfnt_off0000b48e.bin
27e9d6ef70cab1411e77d4284156173363edaefb170abc94e0af3aacbdc9899d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB48E 12584 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.