Malicious PDF — malware analysis report

Static analysis result for SHA-256 d43b921cbd204470…

MALICIOUS

PDF

46.4 KB Created: 2020-08-06 17:38:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0dd6fe1c376434a242e3746096b8dcf2 SHA-1: c4fc59ef744e77ca316335d58a2a4a63f097de5e SHA-256: d43b921cbd204470564834c8fb7f6c5d19e4d47308281359774c41976cb9756b
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a mass of external links, including a redirector to a known malicious infrastructure at 'https://ttraff.ru/pify?keyword=budget+line+economics+pdf'. The document body, though obfuscated, also contains this URL, suggesting the primary purpose is to redirect users to malicious content. The ML classifier strongly supports the malicious verdict.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=budget+line+economics+pdf
    • http://files.christandgod.com/uploads/1/3/1/6/131607063/2916586.pdf
    • http://files.on-demand-marketing.com/uploads/1/3/1/6/131606260/3934fd798f9bf.pdf
    • http://files.weareawebsite.com/uploads/1/3/0/7/130775115/wixisibojebezaz-wevilug.pdf
    • http://japalupe.studiosofneptune.com/uploads/1/3/1/6/131637649/096a7bd76.pdf
    • http://files.clsbaunity2018.org/uploads/1/3/0/8/130873781/8294004f6d7891.pdf
    • https://cdn.shopify.com/s/files/1/0432/9881/6150/files/52875760051.pdf
    • https://cdn.shopify.com/s/files/1/0429/5737/3589/files/xojudebimebimof.pdf
    • https://cdn.shopify.com/s/files/1/0431/0745/1029/files/zaxesaxubexofepawavazen.pdf
    • https://cdn.shopify.com/s/files/1/0432/6473/7438/files/11026359646.pdf
    • https://cdn.shopify.com/s/files/1/0429/9004/3285/files/xedok.pdf
    • https://cdn.shopify.com/s/files/1/0428/9318/1087/files/gukomirejorugobulato.pdf
    • https://cdn.shopify.com/s/files/1/0429/7628/0729/files/saradovazisapitotiba.pdf
    • https://cdn.shopify.com/s/files/1/0438/9748/7512/files/66079152097.pdf
    • https://cdn.shopify.com/s/files/1/0429/4190/7110/files/atomic_orbitals_and_molecular_orbitals.pdf
    • https://cdn.shopify.com/s/files/1/0438/6160/6565/files/24391542912.pdf
    • https://cdn.shopify.com/s/files/1/0436/9232/7077/files/9080456679.pdf
    • https://cdn.shopify.com/s/files/1/0428/9862/0569/files/jigukezixa.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000069cf.bin
a65287d2fae13ef4eff08bb2ced2c14ae04bb751779e9722e38a03f9032af84c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x69CF 5100 bytes
font_01_sfnt_off00007b1d.bin
c8e61cceb7776cc74df538f45c5552e2eadc2828bf7611d8ff50f13453769774		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7B1D 10420 bytes
font_02_sfnt_off00009e7b.bin
1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9E7B 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.