Malicious PDF — malware analysis report

Static analysis result for SHA-256 45b9a299c33f0679…

MALICIOUS

PDF

64.4 KB Created: 2020-08-31 06:24:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c5d9591b6b257a773478112bc736cf2e SHA-1: 2e5e9a0430f3e6bdea0601d5eeb7fc291b13aa5f SHA-256: 45b9a299c33f06798bb5217e5a01b1d3b8cfad5eef314a11d122c771fc5715c1
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a significant number of embedded links, identified as a link farm. One of these links, https://ttraff.ru/wix?keyword=lchf+diet+plan+pdf+in+malayalam, is flagged as a known malicious redirector. The ML classifier also strongly indicated maliciousness. The primary attack pattern appears to be SEO poisoning or a phishing lure through a deceptive link.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=lchf+diet+plan+pdf+in+malayalam
    • https://static.usrfiles.com/ugd/f84671_7d7155a8ea5a4121877ad6a55eec6f88.pdf
    • https://static.usrfiles.com/ugd/b8c837_e17292eb6db1468bb6f5aa040c921649.pdf
    • https://static.usrfiles.com/ugd/b8c837_2dfc249b14ab4e81a7130869703d6bdf.pdf
    • https://cdn.shopify.com/s/files/1/0430/8929/7568/files/1612147189.pdf
    • https://cdn.shopify.com/s/files/1/0441/3823/4008/files/88677420051.pdf
    • https://cdn.shopify.com/s/files/1/0435/8848/5288/files/51932740765.pdf
    • https://cdn.shopify.com/s/files/1/0447/1137/9097/files/bakery_lorraine_menu.pdf
    • https://cdn.shopify.com/s/files/1/0438/2546/3456/files/angadi_theru_movie_isaimini.pdf
    • https://cdn.shopify.com/s/files/1/0438/4541/9170/files/free_english_listening_comprehension_worksheets.pdf
    • https://cdn.shopify.com/s/files/1/0435/8704/3496/files/nuxulometedaga.pdf
    • https://cdn.shopify.com/s/files/1/0430/3123/2674/files/7874693084.pdf
    • https://cdn.shopify.com/s/files/1/0432/7673/0533/files/71090659930.pdf
    • https://cdn.shopify.com/s/files/1/0443/6800/3228/files/befivipetunirajop.pdf
    • https://cdn.shopify.com/s/files/1/0431/8520/9507/files/analysis_of_data_in_research.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00007701.bin
514bc8d0c835e717f2dc48946e49ac9fb2ffe61cbe2b32a25a9f5783acd3cede		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x7701 9788 bytes
font_00_sfnt_off000066c1.bin
c21808eb44433e559d397d379b5bcc063340e984077b8e03dfd2a950477665ca		 pdf-font-stream PDF embedded font (sfnt) at offset 0x66C1 4844 bytes
font_02_sfnt_off0000976b.bin
8b3e0007e4859c637632ff00cab5861c38b943db86b102f7f8f9246f23a004fb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x976B 1740 bytes
font_03_sfnt_off00009fec.bin
c3b892960cd2be370e7a550b4de43e6c986bc2f1243d24405a3fdd08d82e3981		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9FEC 15420 bytes
font_04_sfnt_off0000cf76.bin
ec21d4b665efc6711c8a63b9f708647421e35e96879622c9efbed9fdb9f22fb3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCF76 16392 bytes
font_05_sfnt_off0000e525.bin
ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE525 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.