Malicious PDF — malware analysis report

Static analysis result for SHA-256 fc63289867f6ed5a…

MALICIOUS

PDF

55.3 KB Created: 2020-08-31 22:10:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0fbda1c264e704edc32562c0ee00e1d6 SHA-1: cddc019c7e357298b7718ad86e1d64b90a9891d7 SHA-256: fc63289867f6ed5ab7ddbc34485f14d4da0c79607f61d735c25c6e6046d6b314
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Phishing: Spearphishing Attachment T1204.001 Malicious Link T1059.001 PowerShell

The PDF document contains a lure text "Bengali song site list" and embeds numerous links. One critical heuristic indicates these links point to known malicious redirector infrastructure, specifically `https://ttraff.club/pify?keyword=bengali+song++site+list`. While many other links point to benign Shopify domains, the presence of the malicious redirector suggests a phishing or malicious content delivery attempt. The ML classifier strongly supports the malicious verdict.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/pify?keyword=bengali+song++site+list
    • https://cdn.shopify.com/s/files/1/0434/0842/5123/files/fukunobukojumifewugita.pdf
    • https://cdn.shopify.com/s/files/1/0431/4103/8229/files/87639559740.pdf
    • https://cdn.shopify.com/s/files/1/0430/9906/2421/files/53485824944.pdf
    • https://cdn.shopify.com/s/files/1/0433/1326/6846/files/davotorarenu.pdf
    • https://cdn.shopify.com/s/files/1/0434/8415/1974/files/juxuw.pdf
    • https://cdn.shopify.com/s/files/1/0433/2594/8072/files/99232713394.pdf
    • https://cdn.shopify.com/s/files/1/0430/4614/2114/files/lagemunulitiwezupebosukap.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/banefidofekadozimodomi.pdf
    • https://static.usrfiles.com/ugd/b65acf_473660e451a547cfa9e6e658abcb9bfd.pdf
    • https://static.usrfiles.com/ugd/b8c837_b9f4a6ee314c4b06980cee929825461b.pdf
    • https://static.usrfiles.com/ugd/b8c837_89d8da8f2b6a4b2c941f2cb70477963c.pdf
    • https://static.usrfiles.com/ugd/5fd5c1_2622c27289c74049bee1ccdb772e09e6.pdf
    • https://static.usrfiles.com/ugd/b8c837_652b6f159bf245ed94c64fa9cb778e60.pdf
    • https://static.usrfiles.com/ugd/b8c837_96d04563b91e43d4904875a785eaa00c.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000803d.bin
65ef7398c06120602d598b27ab2b99d5f8946a94b7deb3823e519eac25a1010b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x803D 4596 bytes
font_01_sfnt_off00008fe0.bin
61d223ebaeacf4c7ae126453cfb582b03f75c03ddfe2b7cc9140d30281484fa2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8FE0 4816 bytes
font_02_sfnt_off00009f7b.bin
48a8f1f3084f1957a705ed52a86273b53dae19c5a1ed298867b3f28ac5a7d9dc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9F7B 10288 bytes
font_03_sfnt_off0000c20d.bin
d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC20D 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.