Malicious PDF — malware analysis report

Static analysis result for SHA-256 39c61c2c366633c9…

MALICIOUS

PDF

66.8 KB Created: 2020-07-31 10:14:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f3930284885b241e1bd7979eb34758d2 SHA-1: 83d662d15c93113712ef088690b889186a93993d SHA-256: 39c61c2c366633c95625886403656d8954529c1ad8bcbe8fc8521f3554679d8f
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link T1059.001 PowerShell

The PDF file contains numerous embedded URLs, with a critical heuristic identifying a link to a known malicious redirector. The document body, though heavily obfuscated, suggests a lure related to 'Telugu spiritual books pdf free download'. The presence of a PDF_SEO_LINK_FARM heuristic indicates a tactic to artificially inflate search engine rankings for malicious content. The ML classifier strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=telugu+spiritual+books+pdf+free+download
    • http://files.ecosystemarts.org/uploads/1/3/0/8/130874474/pamujoduwut-melixanogob-toguwapi.pdf
    • http://files.jericosoundsystems.com/uploads/1/3/0/7/130739069/tokoge.pdf
    • http://files.borizjersey.com/uploads/1/3/0/8/130814706/xarukol.pdf
    • http://files.sandysfashionsformen.com/uploads/1/3/2/6/132695372/3254917.pdf
    • http://files.dkfipta.org/uploads/1/3/1/4/131453684/rikikamupetukoj-zifukopavapu-gewene.pdf
    • https://cdn.shopify.com/s/files/1/0431/2553/8973/files/90279413147.pdf
    • https://cdn.shopify.com/s/files/1/0439/3123/8555/files/10465256114.pdf
    • https://cdn.shopify.com/s/files/1/0431/2429/3794/files/fonuludafovugovifetoxo.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/gidawibozifuniji.pdf
    • https://cdn.shopify.com/s/files/1/0440/0755/5222/files/lufebarawokojixegetopili.pdf
    • https://cdn.shopify.com/s/files/1/0431/1502/0448/files/wuwimosatixe.pdf
    • https://cdn.shopify.com/s/files/1/0430/8100/7255/files/33350892435.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/21086069096.pdf
    • https://cdn.shopify.com/s/files/1/0431/9831/6705/files/zevogopuzapegagu.pdf
    • https://cdn.shopify.com/s/files/1/0437/4652/5338/files/vivebavotogokepire.pdf
    • https://cdn.shopify.com/s/files/1/0430/8339/9329/files/xowem.pdf
    • https://cdn.shopify.com/s/files/1/0428/3393/6547/files/nedujuwopu.pdf
    • https://cdn.shopify.com/s/files/1/0429/4295/5687/files/68061420764.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000acce.bin
08a3bd565000d861f3ab44fdfab37b2ca297296ac1d37c87feb161eec3fb413a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xACCE 5336 bytes
font_01_sfnt_off0000bf08.bin
7deeb01a0569afa2b34de63bb5639e4e1a90929f49e903a8224ff58d929244b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xBF08 7764 bytes
font_02_sfnt_off0000d6d3.bin
46a709eadd246dd444eae72aa7ffc621984c8acba127bb0f0c9081f31bf64d2c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD6D3 11436 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.