Malicious PDF — malware analysis report

Static analysis result for SHA-256 54d905f1d74d0039…

MALICIOUS

PDF

45.9 KB Created: 2020-10-10 14:35:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-26
MD5: f536bacf2fb76ae3643c35e126b2813a SHA-1: d1c00b740828ee3664daf1c6e52ac9dc7655b040 SHA-256: 54d905f1d74d003991a60cdf3b9413a177ccfd231e13d3a829fc8b03c8ac3dc4
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a critical heuristic indicating it links to known malicious redirector infrastructure. The document body, though heavily obfuscated, contains text related to an 'aircraft purchase agreement' and includes a URL that appears to be part of a link farm. This suggests the document's primary purpose is to redirect users to malicious sites, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/pify?keyword=aircraft+purchase+agreement+fly+by+night In PDF document text
    • http://files.thebrightestday.net/uploads/1/3/1/4/131437669/xirixezikal.pdfIn PDF document text
    • http://files.wastecontrolservice.net/uploads/1/3/1/4/131437668/dulewivixili-fopof.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://cdn.shopify.com/s/files/1/0483/4997/0583/files/so_far_from_the_bamboo_grove_characters.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0501/1819/7398/files/tonidijisiwetota.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0433/6094/4286/files/venafimikut.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0481/4598/9783/files/how_many_covalent_bonds_does_iodine_form.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5f315815-511e-41b6-b71e-82d55c2249d8/jutebewu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/71896367-e63c-4733-b724-f19a7a14eafb/55668433741.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6f4cfb64-f5a2-4dd6-a496-53a66623e3a6/bidozovojolataxorewawamav.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f0152d47-f4e4-443a-8a08-d7ec00f306ed/govok.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/960c2bc2-119f-481a-a65f-473e348ccb26/panexinabufazidiwoki.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f7084f40-f097-4b5f-871c-c5a0fc0db12c/kamuwiminijovubalaraju.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6e1e2b8f-67d8-422b-9893-ae683c67c5da/9452215554.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000072bd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x72BD 5660 bytes
SHA-256: e1fa4775d4945177177604e4fe7407e4f353970d311db73648ec99a2df91fe70
font_01_sfnt_off000085dd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x85DD 10868 bytes
SHA-256: eb1573170fb9299e05d64496432887063814abc3cdbdafd3eca135f8f5253bb8

Open this report in the interactive analyzer, or submit your own file for analysis.