Malicious PDF — malware analysis report

Static analysis result for SHA-256 34a0e527bbf167aa…

MALICIOUS

PDF

519.2 KB Created: 2020-08-14 01:16:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-17
MD5: d957c803437da77c25c6a583c708cd72 SHA-1: b4f0eee2a282dfd3015b6b34a52c456001bd0f06 SHA-256: 34a0e527bbf167aadb49a29ee9fc4f7d837d4eef2316725d336cddb35a40041c
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF contains a heuristic firing for a malicious redirector link, pointing to 'https://ttraff.cc/pify?keyword=chapter+2+format+research+paper'. The document body, though heavily obfuscated, contains similar text and the malicious URL. The ML classifier also flagged this PDF with high confidence. The presence of a malicious redirector suggests an attempt to lead the user to a malicious site for phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9787

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=chapter+2+format+research+paper In PDF document text
    • http://files.flowergirlnaturals.com/uploads/1/3/1/0/131069879/12c26acc5aa64.pdfIn PDF document text
    • http://files.blackwomenstaskforce.org/uploads/1/3/1/4/131406849/ragazujoliduj.pdfIn PDF document text
    • http://malojak.sharongulezianjewelry.com/uploads/1/3/1/8/131856257/9964104.pdfIn PDF document text
    • http://files.southwestpaddlecompany.com/uploads/1/3/1/4/131407183/4c40fabd.pdfIn PDF document text
    • http://lawufu.deemashahin.net/uploads/1/3/0/8/130814328/5339405.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://cdn.shopify.com/s/files/1/0429/1778/9862/files/ccie_security_free_download.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0434/0865/4492/files/jevirifemu.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0435/2750/4024/files/botunujuvabufebagolad.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0434/3437/7377/files/44324631930.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0440/6067/2165/files/criterion_referenced_test_examples.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0429/7441/2949/files/wondershare_video_editor_free_for_pc.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0436/1060/3677/files/vugarobafisudog.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0434/0183/8757/files/2885999235.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/46150969179.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0434/3801/4616/files/25108094651.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0007b18f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7B18F 5012 bytes
SHA-256: 6dabc3f24dd9da0f07f896d3fb16947fe24a37612349cc81aa686e90315908b4
font_01_sfnt_off0007c2a0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7C2A0 19036 bytes
SHA-256: d92686ba96c2e9c0e4b7b35a89071396d77dadfd644c56ed46dcb4f923659ac9
font_02_sfnt_off0007fceb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7FCEB 4324 bytes
SHA-256: 1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e

Open this report in the interactive analyzer, or submit your own file for analysis.