Malicious PDF — malware analysis report

Static analysis result for SHA-256 b59805761078d3e7…

MALICIOUS

PDF

145.0 KB Created: 2020-08-08 07:16:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9af21da2e016e98876b1249814fe3a12 SHA-1: c4c19969db91647f9276085b3f3f2a05c86865d3 SHA-256: b59805761078d3e7e176cdd40323a69653180c3a88881d1729ca3c460ab56ecc
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains numerous links, including one pointing to a known malicious redirector at 'https://ttraff.com/pify?keyword=bible+aramaic+pdf'. The document body, though heavily obfuscated, appears to contain keywords related to 'Bible aramaic pdf', suggesting a lure to disguise the malicious intent. The ML classifier strongly flagged this PDF as malicious, and the presence of a link farm further supports a malicious distribution or phishing campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=bible+aramaic+pdf
    • http://xojik.dancersmovementlab.com/uploads/1/3/2/6/132682787/8024a68893a.pdf
    • http://files.rwspeech.com.au/uploads/1/3/1/4/131408364/dd3fe6afa4e53.pdf
    • http://files.truthlifevictorychurch.org/uploads/1/3/1/3/131380870/saworosezitasuwap.pdf
    • http://files.omsairaksha.com/uploads/1/3/1/4/131407135/roxeduxesexu-legexek-dexive.pdf
    • http://files.cairngormsnaturalburials.co.uk/uploads/1/3/2/6/132681443/b34bddd0e139c2e.pdf
    • https://cdn.shopify.com/s/files/1/0439/3543/2859/files/mibivulinezogi.pdf
    • https://cdn.shopify.com/s/files/1/0434/0803/1893/files/sibopivitumazavawupizer.pdf
    • https://cdn.shopify.com/s/files/1/0431/8678/2369/files/89928353208.pdf
    • https://cdn.shopify.com/s/files/1/0431/2878/3002/files/71540134443.pdf
    • https://cdn.shopify.com/s/files/1/0429/6779/3817/files/xolenanazufedapona.pdf
    • https://cdn.shopify.com/s/files/1/0434/2120/4631/files/74598517389.pdf
    • https://cdn.shopify.com/s/files/1/0432/5569/3470/files/5772654448.pdf
    • https://cdn.shopify.com/s/files/1/0428/7810/7811/files/waneje.pdf
    • https://cdn.shopify.com/s/files/1/0433/8240/7335/files/ascending_order_program_in_8086_microprocessor.pdf
    • https://cdn.shopify.com/s/files/1/0429/2627/6775/files/operatoria_dental_barrancos_booksmedicos.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/31931154882.pdf
    • https://cdn.shopify.com/s/files/1/0436/1604/3171/files/jarazuxij.pdf
    • https://cdn.shopify.com/s/files/1/0435/3848/1311/files/pifodajobefezodovudu.pdf
    • https://cdn.shopify.com/s/files/1/0437/6009/1287/files/43616539034.pdf
    • https://cdn.shopify.com/s/files/1/0433/9240/1566/files/79411905643.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001d4c3.bin
420e959b56cbb628e597980e85ee9850f3f9dc12a96dec001698538d23afe5ca		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1D4C3 13184 bytes
font_01_sfnt_off0001ff48.bin
dfbdeefc3945c45bf82678c8f0ffc1ea8e62e9a50c63c5715eeeaa5121d7fee8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1FF48 5312 bytes
font_02_sfnt_off00021140.bin
d7c0d192219bc81c39ba3b8dee20f796f6a096eb62cad603b061b20d6e63782a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x21140 10052 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.