Malicious PDF — malware analysis report

Static analysis result for SHA-256 025a12386db911be…

MALICIOUS

PDF

46.3 KB Created: 2020-08-07 23:33:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2f421ee1f5d4b9bae7657e29229c8169 SHA-1: c385ffc481091ad81b77f8ce20743cac000733c6 SHA-256: 025a12386db911be91e214d437e1f92b2a5328c87919632578fa946d6b38f9b9
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document contains a large number of external links, many of which point to benign Shopify domains, but one critical link redirects to a known malicious infrastructure at ttraff.ru. The document body, though heavily obfuscated, contains the same academic-sounding title and the malicious URL, suggesting a lure to a link farm designed to redirect users to malicious content. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wb?keyword=clasificacion%20de%20las%20plantas%20angiospermas%20y%20gimnospermas%20pdf
    • http://files.vk3sn.net/uploads/1/3/1/8/131871894/d40f274a4b81b4.pdf
    • http://files.soapbarlounge.com/uploads/1/3/0/7/130776718/luriza_bokitewakikizu_sepipe.pdf
    • http://resedej.theveilkc.com/uploads/1/3/2/7/132740900/nivabozomujalusiso.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://cdn.shopify.com/s/files/1/0427/9474/6023/files/definition_of_assessment_in_education.pdf
    • https://cdn.shopify.com/s/files/1/0440/1886/0190/files/28105294994.pdf
    • https://cdn.shopify.com/s/files/1/0431/3301/0082/files/logavuxuzebiba.pdf
    • https://cdn.shopify.com/s/files/1/0439/0138/6920/files/11175565534.pdf
    • https://cdn.shopify.com/s/files/1/0432/9222/9797/files/apache_solr_index_files.pdf
    • https://cdn.shopify.com/s/files/1/0428/4219/4083/files/nikawu.pdf
    • https://cdn.shopify.com/s/files/1/0433/0219/1269/files/wemovaguzebibufunefi.pdf
    • https://cdn.shopify.com/s/files/1/0429/4947/6518/files/tozukokisirap.pdf
    • https://cdn.shopify.com/s/files/1/0433/5206/4155/files/57279497969.pdf
    • https://cdn.shopify.com/s/files/1/0428/7227/5103/files/mubaweri.pdf
    • https://cdn.shopify.com/s/files/1/0433/2745/5387/files/manual_formulas_excel_2020.pdf
    • https://cdn.shopify.com/s/files/1/0431/0489/5143/files/relorimepidut.pdf
    • https://cdn.shopify.com/s/files/1/0437/1863/9765/files/modern_bioelectricity.pdf
    • https://cdn.shopify.com/s/files/1/0434/3513/1046/files/71522740982.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000696a.bin
f1891086052d629ec41cf6b2b722dc3b967327a4ed3bb40b0b42deeae1f21748		 pdf-font-stream PDF embedded font (sfnt) at offset 0x696A 5388 bytes
font_01_sfnt_off00007ba9.bin
b1e81b5c673e4a9a3844496d2444126838744e593c35115aef1e4c1b743ef538		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7BA9 9948 bytes
font_02_sfnt_off00009daa.bin
781b9fae2fb9201b4a05d2041fea553bb2973f1d011ab9c51e3326c72e342c60		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9DAA 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.