Malicious PDF — malware analysis report

Static analysis result for SHA-256 59c00c46529a6380…

MALICIOUS

PDF

57.4 KB Created: 2020-08-07 15:52:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: eb0928fc707450865fab83f29875ba04 SHA-1: 498babf8b5e8eb7a0b346307064af498a7ef61f4 SHA-256: 59c00c46529a6380329efda09a5f258b0d092ac2f455e5d14a5532db66bbba13
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links, many of which point to domains associated with link farms and redirectors. The primary malicious URL identified is https://ttraff.ru/pify?keyword=veda+mantras+in+malayalam+pdf, which is flagged as a known malicious redirector. The document body, though heavily obfuscated, contains references to the same URL and other PDF files hosted on potentially malicious domains. The ML classifier strongly indicated maliciousness, supporting the conclusion that this PDF is designed to redirect users to harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=veda+mantras+in+malayalam+pdf
    • http://rizolob.minimalotta.com/uploads/1/3/1/4/131437462/vowogula-junaxa-xafilipobe.pdf
    • http://wuravo.dieterwentzel.com/uploads/1/3/0/8/130873804/438f64.pdf
    • http://files.cheddarscbds.com/uploads/1/3/1/1/131163859/nixex.pdf
    • http://difugepop.cranberrylaundry.com/uploads/1/3/0/9/130969204/76f7199c19.pdf
    • http://files.tranquilpalmsmaui.com/uploads/1/3/1/1/131163834/7013454.pdf
    • https://cdn.shopify.com/s/files/1/0434/1704/3111/files/33902189988.pdf
    • https://cdn.shopify.com/s/files/1/0433/1149/7366/files/lenukakupidawipufozevuda.pdf
    • https://cdn.shopify.com/s/files/1/0431/5453/8656/files/celulas_caliciformes.pdf
    • https://cdn.shopify.com/s/files/1/0431/2029/6090/files/honestech_tvr_2._5.pdf
    • https://cdn.shopify.com/s/files/1/0436/3301/6982/files/85801175306.pdf
    • https://cdn.shopify.com/s/files/1/0438/0616/3104/files/75909569142.pdf
    • https://cdn.shopify.com/s/files/1/0434/3876/8294/files/57651843378.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/pepefawabibuf.pdf
    • https://cdn.shopify.com/s/files/1/0439/8333/9678/files/wasadowijuzokixugoro.pdf
    • https://cdn.shopify.com/s/files/1/0432/1021/1491/files/tinker_s_construct_ecological.pdf
    • https://cdn.shopify.com/s/files/1/0434/8038/3653/files/sulomogetamevujukulibapew.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008848.bin
597de781540f6b17f7b888bfa93db64d4ed96f66f4ee1bc5a4b0bc3c8dbebca2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8848 4932 bytes
font_01_sfnt_off000098ea.bin
d63d46cd2c77ea1016aa90527409486a54ff91b8a075529b974590a2af8f58eb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x98EA 3936 bytes
font_02_sfnt_off0000a6da.bin
5317c16fc8f29ff17f3295817f4018bee1db2f48915fbf2421f79b182ba65950		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA6DA 10408 bytes
font_03_sfnt_off0000ca42.bin
4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCA42 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.