Malicious PDF — malware analysis report

Static analysis result for SHA-256 1a95ab911ca9922d…

MALICIOUS

PDF

50.3 KB Created: 2020-08-11 18:50:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 062967ad8cc4e284c30851b468840f8a SHA-1: a0e9aca22d8fcf4102b55a81c8f19fe1b48e6026 SHA-256: 1a95ab911ca9922d241b9c891ccd9f7eaa029e520956587bc4a7cdab04ca3898
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a prominent link to 'ttraff.com', identified as a malicious redirector. This URL is presented within the document body and is associated with a heuristic firing for PDF_MALICIOUS_REDIRECTOR_LINK. The document also exhibits characteristics of a PDF link farm, with numerous embedded links, many pointing to Shopify domains, likely for SEO manipulation to drive traffic to the malicious redirector. The overall goal appears to be to trick users into clicking the malicious link under the guise of providing useful information.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=aptitude+shortcut+tricks+pdf+download
    • http://files.undertheskynews.org/uploads/1/3/1/8/131856852/fagome.pdf
    • http://files.alissabethphoto.com/uploads/1/3/0/9/130969247/e9aab9e.pdf
    • http://files.fwmihk.org/uploads/1/3/2/3/132302993/muguju.pdf
    • https://cdn.shopify.com/s/files/1/0437/1149/6347/files/42244931130.pdf
    • https://cdn.shopify.com/s/files/1/0438/1219/2413/files/mepuwazom.pdf
    • https://cdn.shopify.com/s/files/1/0429/3669/6995/files/25124921711.pdf
    • https://cdn.shopify.com/s/files/1/0432/6768/6556/files/35757329303.pdf
    • https://cdn.shopify.com/s/files/1/0428/7833/7187/files/45463197179.pdf
    • https://cdn.shopify.com/s/files/1/0429/3525/5203/files/xiponubivonekor.pdf
    • https://cdn.shopify.com/s/files/1/0433/0812/2280/files/5683339872.pdf
    • https://cdn.shopify.com/s/files/1/0437/9167/9639/files/dajenikulaxejune.pdf
    • https://cdn.shopify.com/s/files/1/0429/2024/7462/files/17763109419.pdf
    • https://cdn.shopify.com/s/files/1/0429/1565/9942/files/sejosiwamazejimaniwudari.pdf
    • https://cdn.shopify.com/s/files/1/0431/1177/6416/files/vopelule.pdf
    • https://cdn.shopify.com/s/files/1/0439/4608/2472/files/47425274457.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006062.bin
5b231651dba9eaa0dc74d623479817ff8a868209e11f34b8c085c4d1a94a18dc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6062 5388 bytes
font_01_sfnt_off000072ba.bin
33d80b5e357abfa3ea91f5eff18928953f8e36d8e9a7aea158c838e8ae756dd9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x72BA 2116 bytes
font_02_sfnt_off00007c84.bin
61bb05fa349f221b30327fea8874d33b6339fa17a1d10ad6ff3952ec49bd3cac		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7C84 10108 bytes
font_03_sfnt_off00009f21.bin
d73df57d46cacd7bc4e90a22257ceaff8e81036fbe0a6e27afc82341d9ddb325		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9F21 8024 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.