Malicious PDF — malware analysis report

Static analysis result for SHA-256 f3e59db87a44eede…

MALICIOUS

PDF

51.9 KB Created: 2020-08-18 22:10:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-26
MD5: f6f0b1f187b4d4431e3d92cd5e665712 SHA-1: 3cf3dbfbf85e05bb2efd012bbc3c0f88f610e5bb SHA-256: f3e59db87a44eedebfac5bd04edeb044edce61a98fdfe7ab4ec4962cb2bafccc
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains embedded links, one of which, 'https://ttraff.com/pify?keyword=dhangar+aarakshan+video', is identified as a malicious redirector. The document body, though heavily obfuscated, contains references to this URL and appears to be a lure. The presence of numerous other PDF links suggests a link farm or SEO manipulation tactic to distribute malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=dhangar+aarakshan+video In PDF document text
    • http://files.siiivisuals.com/uploads/1/3/0/7/130775808/1b5bf4.pdfIn PDF document text
    • http://files.ccmhcounseling.com/uploads/1/3/1/3/131383982/duvikotabot.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • https://cdn.shopify.com/s/files/1/0440/5320/1046/files/php_get_memory_usage.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0433/7929/4358/files/sezuvitujalaseratovit.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0437/6811/9448/files/16647317515.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0431/1344/7581/files/fikolixedesexobav.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0433/2955/2552/files/povepakubegelulu.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0440/7679/4021/files/clicker_heroes_guide_cool_math.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0428/2214/0070/files/jezufexa.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0434/4673/0904/files/yoga_exercises_for_weight_loss.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0432/8819/9328/files/neviderodibi.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000552b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x552B 4884 bytes
SHA-256: 201eebd53b880d35a620e39edfd2ef03409fca00d262fca53ae5241f9131ebbd
font_01_sfnt_off000065af.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x65AF 1936 bytes
SHA-256: 73983ccd477f0e4c07634362c0f9f13a23cea415a26bff37f7f125d59a681190
font_02_sfnt_off00006ef2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6EF2 14680 bytes
SHA-256: 38c1a324219eda9cec3981c5ce482e713a1afc3eb5be061b424daf2ef0f94d0f
font_03_sfnt_off00009da4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9DA4 4324 bytes
SHA-256: 0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333
font_04_sfnt_off0000aba5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xABA5 6596 bytes
SHA-256: 3f57c21e08aa8be93ca36381c23b71da54aabbe6e77704c0c43eeece6320e502

Open this report in the interactive analyzer, or submit your own file for analysis.