Malicious PDF — malware analysis report

Static analysis result for SHA-256 cda4ffbdad0bd3ef…

MALICIOUS

PDF

45.1 KB Created: 2020-09-05 23:36:26 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0c5bfb8080ab18182cf8c45e9478dabe SHA-1: ff1e5aa3f3c38219e09dacb8304b129f6face0ad SHA-256: cda4ffbdad0bd3ef40a4fc54f6e76a9f165d24feb3211dd9fcd63ef415819909
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a link disguised as sheet music, which redirects to a known malicious domain. The ML classifier strongly indicated maliciousness, and the PDF_MALICIOUS_REDIRECTOR_LINK heuristic confirms the presence of a link to malicious infrastructure. The document body, though heavily obfuscated, contains the lure text and the malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=bohemian+rhapsody+piano+music+sheet+easy
    • https://static.usrfiles.com/ugd/7be1cd_9dcf0393dfcc48aa890f23665920ac8f.pdf
    • https://static.usrfiles.com/ugd/3402b1_420900630f8e4ebb9965be2750e83d10.pdf
    • https://static.usrfiles.com/ugd/c1615c_50feb7fd820840ba8dbfe09185494ee3.pdf
    • https://static.usrfiles.com/ugd/b8c837_fdac5216c419411fbf86e9ccc374eabb.pdf
    • https://static.usrfiles.com/ugd/fef806_7e1021520d1545fcaae614699f3de225.pdf
    • https://static.usrfiles.com/ugd/05900a_f394fc7d9269492da40db1306f1bfb76.pdf
    • https://static.usrfiles.com/ugd/1d64af_c973da0b310048bf8e23af688d4c579c.pdf
    • https://static.usrfiles.com/ugd/a18aa6_a24970c20a914ee5a5dd4d013b8afd92.pdf
    • https://static.usrfiles.com/ugd/197ed4_fdcf0e83616f404cae9b0fb8ef8d077b.pdf
    • https://static.usrfiles.com/ugd/d3758e_c6a4329e98db441f9b96c2e2611d459b.pdf
    • https://cdn.shopify.com/s/files/1/0435/2219/5608/files/tubetofodixirivo.pdf
    • https://cdn.shopify.com/s/files/1/0437/6359/7473/files/30715151068.pdf
    • https://cdn.shopify.com/s/files/1/0439/8376/5662/files/brain_teaser_quiz.pdf
    • https://cdn.shopify.com/s/files/1/0429/3810/6023/files/curriculum_vitae_template_free_doc.pdf
    • https://cdn.shopify.com/s/files/1/0433/7182/3262/files/hp_officejet_pro_8500_manuals.pdf
    • https://cdn.shopify.com/s/files/1/0432/6083/8050/files/atos_e_fatos_administrativos.pdf
    • https://cdn.shopify.com/s/files/1/0427/6515/6508/files/nezen.pdf
    • https://cdn.shopify.com/s/files/1/0462/1061/3401/files/naqaab_bengali_movie_hd_video_song.pdf
    • https://cdn.shopify.com/s/files/1/0437/2001/6021/files/56069789947.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000070f4.bin
79e910da937eb2cd95eaed0e933c27ab4600288ad6bad1e7dc5d6c4298dae05f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x70F4 5432 bytes
font_01_sfnt_off00008345.bin
75c2927a5489aebb0f54d2b1f80b6baa70da6c0aaa39d8eec64539f891811688		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8345 10324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.