Malicious PDF — malware analysis report

Static analysis result for SHA-256 d1f3f77c1b9d1005…

MALICIOUS

PDF

116.2 KB Created: 2020-09-08 04:04:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: 35a93ccfb6ed86d2a107451c4052df18 SHA-1: 61ee1b9b7652fc4c18305b7f3e8ec12da78ee559 SHA-256: d1f3f77c1b9d10055a3890c5d1c97793077b7f9301ad1f7c5b0235b788ec215f
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document contains a mass of external links, many of which point to benign Shopify URLs, but one critical link directs to a known malicious redirector at https://ttraff.com/wix. The document body and embedded links are designed to appear as search results for "kadhali album songs in masstamilan", likely to trick users into clicking the malicious link. The ML classifier strongly flagged this PDF as malicious, supporting the assessment of a phishing or redirection attack.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=kadhali+album+songs++in+masstamilan In PDF document text
    • http:///\/www.paadalvarigal.com\/2864\/i-am-so-cool-kaaki-sattai-2015-song-lyrics.html,video_url:,zoomit:0,premium_content:0,rest_lev:0,rest_msg_free:null,rest_msg_paid:null,_e:0,aes_enabled:1,aet:1,release_date:SepIn PDF document text
    • http:///\/www.paadalvarigal.com\/2865\/kattikida-kaaki-sattai-2015-song-lyrics.html,video_url:,zoomit:0,premium_content:0,rest_lev:0,rest_msg_free:null,rest_msg_paid:null,_e:0,aes_enabled:1,aet:1,release_date:SepIn PDF document text
    • http:///\/www.paadalvarigal.com\/2527\/poo-indru-neeyaga-velaiyilla-pattathari-song-lyrics.html,video_url:,zoomit:0,premium_content:0,rest_lev:0,rest_msg_free:null,rest_msg_paid:null,_e:0,aes_enabled:1,aet:1,release_date:FebIn PDF document text
    • http:///\/tamilsongslyrics.org\/velaiyilla-pattathari-lyrics-vip-title-velai-illa-pattadhaari-348,video_url:,zoomit:0,premium_content:0,rest_lev:0,rest_msg_free:null,rest_msg_paid:null,_e:0,aes_enabled:1,aet:1,release_date:FebIn PDF document text
    • http:///\/www.tsonglyrics.com\/2014\/02\/ey-inga-paaru-lyrics-velaiyilla.html,video_url:,zoomit:0,premium_content:0,rest_lev:0,rest_msg_free:null,rest_msg_paid:null,_e:0,aes_enabled:1,aet:1,release_date:FebIn PDF document text
    • http:///\/www.paadalvarigal.com\/3572\/neeyum-naanum-naanum-rowdydhaan-song-lyrics.html,video_url:,zoomit:0,premium_content:0,rest_lev:0,rest_msg_free:null,rest_msg_paid:null,_e:0,aes_enabled:1,aet:1,release_date:SepIn PDF document text
    • http:///\/www.paadalvarigal.com\/3574\/yennai-maatrum-kadhale-naanum-rowdydhaan-song-lyrics.html,video_url:,zoomit:0,premium_content:0,rest_lev:0,rest_msg_free:null,rest_msg_paid:null,_e:0,aes_enabled:1,aet:1,release_date:SepIn PDF document text
    • http:///\/www.paadalvarigal.com\/3598\/varavaa-varavaa-naanum-rowdydhaan-song-lyrics.html,video_url:,zoomit:0,premium_content:0,rest_lev:0,rest_msg_free:null,rest_msg_paid:null,_e:0,aes_enabled:1,aet:1,release_date:SepIn PDF document text
    • http:///\/www.paadalvarigal.com\/3846\/hey-mama-sethupathi-song-lyrics.html,video_url:,zoomit:0,premium_content:0,rest_lev:0,rest_msg_free:null,rest_msg_paid:null,_e:0,aes_enabled:1,aet:1,release_date:JanIn PDF document text
    • http:///\/www.lyricsinbox.com\/5185\/uyire-un-In PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://cdn.shopify.com/s/files/1/0439/2439/0056/files/30000453375.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0429/8535/7463/files/81320945953.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0432/4789/4683/files/caerleon_comprehensive_uniform.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0429/3502/5831/files/ovarian_cyst_natural_treatment.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0429/5920/8604/files/banyans_surf_report.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0434/6000/1957/files/52672538193.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0429/5901/2006/files/59376863035.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0428/9226/3583/files/2594180734.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0438/0744/1053/files/diroluzisivelinusapoza.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0429/7365/9290/files/14855822838.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0432/4491/2802/files/givomebimegedaditafoz.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/895bef_a76a259447784887bda69a7ac9acaa41.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/4826f5_956fe58c65d040c2b7efc17313030cb0.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/0a0016_3b6ce65f7c11408cbfdedffe47633d04.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00018866.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x18866 5252 bytes
SHA-256: d8c110305e6beefdc4ce202ec72e1b600887880952bb5b07111167ef0b1e1c93
font_01_sfnt_off00019a22.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x19A22 13244 bytes
SHA-256: caf0ca9a6eaeb3a3a7e704eaa5c5e0a8b46fa3aecd97a08bd2e897477fd87a5f

Open this report in the interactive analyzer, or submit your own file for analysis.