Malicious PDF — malware analysis report

Static analysis result for SHA-256 69e8d97d83a2061d…

MALICIOUS

PDF

42.8 KB Created: 2020-08-11 08:12:26 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2155ac634db3c107708761dce5a1ca6a SHA-1: 6dd991372cec3198c7715210cc878d5129b0f0e9 SHA-256: 69e8d97d83a2061da62af6c8e022aa8689afccf2db095e319f3cf170edbd0db0
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous links, with one identified as a known malicious redirector infrastructure. The ML classifier strongly indicates maliciousness, and the presence of embedded URLs suggests an attempt to lure users to malicious sites. The document body, though heavily obfuscated, contains the URL https://ttraff.ru/pify?keyword=clinical+anesthesia+morgan+pdf, reinforcing the redirection attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=clinical+anesthesia+morgan+pdf
    • http://files.melaniemasters.com/uploads/1/3/1/4/131437385/lefom_tivuzuvupip_funapuxaxotevo.pdf
    • http://files.theinformedslp.com/uploads/1/3/0/9/130969772/ziwiju.pdf
    • http://files.fauxmesticgoddess.com/uploads/1/3/1/8/131856381/gevaxil.pdf
    • http://jomer.sacredsilver.com/uploads/1/3/1/6/131606490/vasimipejobalu.pdf
    • http://lajizaj.ivonacustominteriors.com/uploads/1/3/2/7/132741099/xixudaze.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0428/2990/6079/files/5966164357.pdf
    • https://cdn.shopify.com/s/files/1/0436/9219/5993/files/hallelujah_lyrics_sheet_music.pdf
    • https://cdn.shopify.com/s/files/1/0432/3947/3314/files/39092020963.pdf
    • https://cdn.shopify.com/s/files/1/0434/0521/3854/files/29148366441.pdf
    • https://cdn.shopify.com/s/files/1/0430/2379/4339/files/geveterenezid.pdf
    • https://cdn.shopify.com/s/files/1/0429/8365/3527/files/60873199508.pdf
    • https://cdn.shopify.com/s/files/1/0429/2670/2758/files/business_administration_and_management_free_download.pdf
    • https://cdn.shopify.com/s/files/1/0440/6044/2774/files/runavazoki.pdf
    • https://cdn.shopify.com/s/files/1/0434/5259/6374/files/business_plan_small_restaurant.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005465.bin
d90656d0b8faab6d02c7fb382b5f7506e85ab212c7c1e1397cef9b3ffd664b88		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5465 6384 bytes
font_01_sfnt_off000069e2.bin
e1fc4eee76a72b02c147afdbff2066fee8fa0b77023bf8ebc78f952d7924b200		 pdf-font-stream PDF embedded font (sfnt) at offset 0x69E2 5476 bytes
font_02_sfnt_off00007c41.bin
9d1d2e83da7e7f1ede395227c57aebdaea88347f505e4f51892b6b13fdb76802		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7C41 9692 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.