Malicious PDF — malware analysis report

Static analysis result for SHA-256 fd9023159d2bbc51…

MALICIOUS

PDF

161.3 KB Created: 2020-10-23 19:56:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: 82cebf7a6d85df9df54ddc905874964c SHA-1: 1f2cf1d3c0af50c677cc60a7559caf527e242a99 SHA-256: fd9023159d2bbc51598fa54f698f1e43d7b17bac66c0268e851757a13fbc6615
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing indicating it links to known malicious redirector infrastructure. The embedded URL, 'https://ttraff.me/aws?keyword=railway+station+code+pdf+india', is the primary indicator of malicious intent. While no scripts were extracted, the presence of a malicious link within the document body strongly suggests a phishing or redirection attack, likely delivered as a spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/aws?keyword=railway+station+code+pdf+india In PDF document text
    • https://donikigegetala.weebly.com/uploads/1/3/4/3/134311768/9104911.pdfIn PDF document text
    • https://zozilevijuni.weebly.com/uploads/1/3/1/3/131383476/74ed6154ece.pdfIn PDF document text
    • https://tisatazufewuvo.weebly.com/uploads/1/3/1/1/131163687/sukojiz_leludebasitov_riwatexopixo_joteligaj.pdfIn PDF document text
    • https://nukubutoti.weebly.com/uploads/1/3/2/3/132302768/1731680.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4373239/normal_5f91591ee1df3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365570/normal_5f91d6c8c607f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365998/normal_5f8d0d72273f2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366017/normal_5f875002d6bdd.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://cdn.shopify.com/s/files/1/0499/8047/3504/files/45579376222.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0491/6779/4342/files/similarities_between_theory_of_change_and_logic_model.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0482/5953/0906/files/leto_high_school.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0484/0557/7896/files/turn_off_avast_email_signature.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0430/6075/6641/files/whirlpool_gold_dishwasher_quiet_partner_iii_manual.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0435/0282/9734/files/present_simple_and_present_continuous_exercise.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0484/1881/6157/files/52117599277.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d4174a82-ed6b-440d-8af0-033d9b4b3bbe/donufevumukodafa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/90baf2e6-8001-4585-9b5e-3e3dbdaeff54/lumarorazevogipetovitimi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/26b2968d-3ff0-4c02-b43d-dd24acc86b3c/jiriboxaligap.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/96fefd6b-8761-4e0c-b704-3ecde4374c57/88464454710.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0437/5789/5841/files/mta_signal_maintainer_exam_2020.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0503/8650/1806/files/song_cutter_and_joiner_app_for_android.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000225d9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x225D9 5252 bytes
SHA-256: cd3a4d5c282b2662890fc133ea77d8f83773f66980b138221d837b4419c9d672
font_01_sfnt_off000237ef.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x237EF 12740 bytes
SHA-256: b3ede1cfd635d65ea65452598a7052255e13b8fe46d157a59e3739e031979080
font_02_sfnt_off000260d9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x260D9 16164 bytes
SHA-256: e296a61d2d303e35be9e1a35631556663d2780498efa7e8f3867bf557f172fe6

Open this report in the interactive analyzer, or submit your own file for analysis.