Malicious PDF — malware analysis report

Static analysis result for SHA-256 1ae7cdd4427316c2…

MALICIOUS

PDF

37.8 KB Created: 2020-09-17 19:37:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 11b18f2b5e8bc13a91be70cf8d1c9f11 SHA-1: b95b927e6ae62856f2f1a2c6fb0678260bded2bc SHA-256: 1ae7cdd4427316c200cd17fc9394e8725a91b3858fa3e13036caef7974cece82
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.me/wix?keyword=black+and+decker+complete+guide+to+treehouses'. This URL is likely used to redirect users to a malicious site. The document also contains a large number of embedded links to PDFs hosted on Shopify, which is flagged as a link farm. The ML classifier strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=black+and+decker+complete+guide+to+treehouses
    • https://cdn.shopify.com/s/files/1/0430/6095/3249/files/wibujavabum.pdf
    • https://cdn.shopify.com/s/files/1/0465/0549/2638/files/nuwatoxifesu.pdf
    • https://cdn.shopify.com/s/files/1/0433/0497/6548/files/32273084507.pdf
    • https://cdn.shopify.com/s/files/1/0432/5254/7739/files/tozuvivevarojovubap.pdf
    • https://cdn.shopify.com/s/files/1/0433/7103/6822/files/71572767582.pdf
    • https://242b1b86-d481-440c-95e8-22fda7f0d8e1.filesusr.com/ugd/145364_a53b5022b53a4ed99c162c01a6420c5e.pdf?index=true
    • https://0df0f3d2-9316-4f90-8acb-941e9b773133.filesusr.com/ugd/5f5755_e95c0b48e56f4bf898a54a8b64585163.pdf?index=true
    • https://701a4289-99d5-47d3-97b6-0d3c5e00dbb6.filesusr.com/ugd/e3834b_bab076e3f5784e9fb3f3ff1f48e39103.pdf?index=true
    • https://c2c2ff2d-9e22-4d17-87fd-be89f13bebb7.filesusr.com/ugd/225520_8c4620ab816c4445ba7fe632e8b559b6.pdf?index=true
    • https://5e0c64d3-1873-469e-993f-4cc6720e34bb.filesusr.com/ugd/e1c37d_ea7ceb41cd5f493ab6118bb53ceebc77.pdf?index=true
    • https://cdn.shopify.com/s/files/1/0434/3254/2369/files/bozorezumawudipi.pdf
    • https://cdn.shopify.com/s/files/1/0476/4975/1206/files/catholic_book_publishing_missal.pdf
    • https://cdn.shopify.com/s/files/1/0437/1428/1625/files/tmar_mixta_ejemplos.pdf
    • https://3ac41a9c-8c43-4161-9a65-3e9516e8c0ea.filesusr.com/ugd/625844_e5298709410c4f4782808f9533bbd5b2.pdf?index=true
    • https://07c7a7e8-a95e-464c-a7f6-9f50a8ee80c1.filesusr.com/ugd/6924eb_249c6983525546bbb59973f2213d4949.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004777.bin
ff431dd8cac566744cbb9d55b492ae64d47b069cf0b2d4b80c980c6b4dda87ea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4777 5484 bytes
font_01_sfnt_off000059e0.bin
c6813264bdb0c7c4cb82f214d5509b4aa40ef9a71dbf1d75189cd4d3ca18646a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x59E0 9968 bytes
font_02_sfnt_off00007bd3.bin
cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7BD3 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.