Malicious PDF — malware analysis report

Static analysis result for SHA-256 21dd9c1bbbeecb6a…

MALICIOUS

PDF

34.9 KB Created: 2020-08-28 12:45:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c5cddd59ff3eba3bd52cf91f85c2839b SHA-1: d4ce7442fc6f963a792d1c8f4617aedff8ca158b SHA-256: 21dd9c1bbbeecb6ac051555cfc53a4836ccd9967eaf9285b84d3b22d6320a81c
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains numerous embedded links, a technique often used for phishing or redirecting users to malicious sites. One critical heuristic identified a link to a known malicious redirector, specifically `https://ttraff.cc/pify?keyword=singer+tradition+160+manual+de+utilizare`, which is presented in the document body as a Singer sewing machine manual. Another heuristic flagged the PDF for containing a mass external PDF link farm, with many links pointing to `cdn.shopify.com` domains, suggesting an attempt to obscure the true malicious intent or leverage legitimate platforms for hosting. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=singer+tradition+160+manual+de+utilizare
    • http://zoxat.expertrealtyllc.com/uploads/1/3/0/7/130740178/nabifixo_fugovaboz_fiwojisiku.pdf
    • http://pumom.philcohomes.com/uploads/1/3/1/0/131070867/zulawujamimefe.pdf
    • http://files.innerspacehealing.org/uploads/1/3/1/0/131070786/4143122.pdf
    • http://files.maartenderidder.com/uploads/1/3/2/6/132695457/xitunan.pdf
    • https://cdn.shopify.com/s/files/1/0433/7578/8188/files/waterfowl_migration_report.pdf
    • https://cdn.shopify.com/s/files/1/0435/5325/9679/files/kisakeregem.pdf
    • https://cdn.shopify.com/s/files/1/0430/6881/7562/files/les_espaces_productifs_et_leurs_vol.pdf
    • https://cdn.shopify.com/s/files/1/0437/7496/7965/files/lujifevumuruzemituvesafak.pdf
    • https://cdn.shopify.com/s/files/1/0437/9928/1821/files/43701382794.pdf
    • https://cdn.shopify.com/s/files/1/0434/4145/5254/files/adjetivos_posesivos_y_pronombres_posesivos_en_ingles_ejercicios.pdf
    • https://cdn.shopify.com/s/files/1/0429/9672/7962/files/zemikobubatak.pdf
    • https://cdn.shopify.com/s/files/1/0427/6187/9719/files/zajugevunufexavi.pdf
    • https://cdn.shopify.com/s/files/1/0432/5448/1054/files/47970726454.pdf
    • https://cdn.shopify.com/s/files/1/0435/1705/1048/files/nikaxijirifurozowupe.pdf
    • https://cdn.shopify.com/s/files/1/0430/5072/9621/files/25644812422.pdf
    • https://cdn.shopify.com/s/files/1/0437/7224/8222/files/adobe_photoshop_cs2_tutorial_free.pdf
    • https://cdn.shopify.com/s/files/1/0431/3723/7146/files/xakuzutisoludipasalen.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004aa3.bin
80bf7f1e47f73d4db3b37c390c99cf186581bfb1b1e7a53f8b7f5e4a7f36348e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4AA3 5468 bytes
font_01_sfnt_off00005d26.bin
5bbacae0246e89d5886add6165de87147cacc1f7c0746b087f14aa2bb4e46226		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5D26 9780 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.