Malicious PDF — malware analysis report

Static analysis result for SHA-256 5df2c4e19bd8ad3a…

MALICIOUS

PDF

54.8 KB Created: 2020-10-28 20:02:36 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-11
MD5: 6cb1d40fa451bed55b92a1a4e828901f SHA-1: c6977f08b4408feb9d20a6d18c46057d6095021a SHA-256: 5df2c4e19bd8ad3aa0259d9e080db30f6518e4c5cbed2d801a8563f4665576af
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by an ML classifier and contains a link to known malicious redirector infrastructure. The embedded URL, https://ttraff.club/pify?keyword=moriya+shrine+touhou+11, is the primary indicator of malicious intent, likely leading to a phishing or malware download site. No scripts were extracted, but the presence of a malicious URL strongly suggests a phishing or credential harvesting attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/pify?keyword=moriya+shrine+touhou+11 In PDF document text
    • https://cdn-cms.f-static.net/uploads/4415769/normal_5f950eb8e95db.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4402517/normal_5f963282d6e8b.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/f4a16271-fa46-49c8-aea5-d45ebb6bfb1c/zobabitez.pdfIn PDF document text
    • https://s3.amazonaws.com/wilugugo/after_10th_courses_chart_download.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0428/5281/0911/files/mod_organizer_2_skyrim_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/wopari/bumozimodugovojupuva.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0437/3073/1173/files/56335158174.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0499/8823/9510/files/rogibaporarugitazazuv.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0479/6553/6412/files/62914288527.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0434/4227/4471/files/1981_topps_baseball_cards_price_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/badodemebo/emphatic_structures.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8d6b0116-d1c6-4044-95f0-cefa391938fb/52670669844.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9e6a794f-ab3d-458b-8393-adbe7e43f3d0/kelogopubuluzufu.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0481/3884/6359/files/onclick_method_in_android_example.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8a64db9c-0ea0-4d97-b887-9b9950612f2e/wajewirijutekupujatam.pdfIn PDF document text
    • https://s3.amazonaws.com/jutenojamega/52209103323.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5a373c64-40af-41f2-851a-bea261c4abef/85662860753.pdfIn PDF document text
    • https://s3.amazonaws.com/midaguvimabof/reading_aloud_benefits.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0439/1731/2152/files/fabulous_motivate_me_premium_apk.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007a2b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7A2B 7420 bytes
SHA-256: 7fa17a33393d30e13e3ebe9a9e8f63df7b79a81c82b8449326d8418dc19642f2
font_01_sfnt_off00009348.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9348 4900 bytes
SHA-256: 78e0fbaac79273f48fb04351f823f3ddabfe43c024e84a80374d9a2d09b161ea
font_02_sfnt_off0000a3fe.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA3FE 13024 bytes
SHA-256: f3c690dfc4f1b08e03e05865a62fd15f5351d28f110294d753ad984a0bdf91b0

Open this report in the interactive analyzer, or submit your own file for analysis.