Malicious PDF — malware analysis report

Static analysis result for SHA-256 1cbbf8550bb91d5f…

MALICIOUS

PDF

48.8 KB Created: 2020-08-14 11:37:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 19533ee3f7d9e7fcd23f608f12610ec5 SHA-1: 02e738571eb0f460a5416dc2a41c48a0d9ae917a SHA-256: 1cbbf8550bb91d5fde4fba2bcfcb4435d44758073701b952ec5d856e7c14d451
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a link farm with 17 external links, including a critical redirector link to ttraff.ru. The ML classifier also strongly indicated maliciousness. The document body contains obfuscated text and URLs, suggesting an attempt to lure users to malicious sites, likely for further exploitation or credential harvesting.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=lagu+baridin+ratminah
    • http://files.barskinproducts.com/uploads/1/3/1/4/131438150/4487424.pdf
    • http://nitipate.caseyclaros.com/uploads/1/3/1/4/131406390/fusapepasijeb.pdf
    • http://kumid.deafcrowscollective.ca/uploads/1/3/1/4/131437044/6216966.pdf
    • http://files.cherylaperkins.com/uploads/1/3/2/3/132302916/tadiwedezume_sabuzevomuni_lojatujakaj_wuwibasisafexu.pdf
    • http://badul.eatingnosetotail.com/uploads/1/3/1/4/131482975/c8c28899.pdf
    • https://cdn.shopify.com/s/files/1/0431/0047/1456/files/7384926039.pdf
    • https://cdn.shopify.com/s/files/1/0428/0962/2691/files/59385002131.pdf
    • https://cdn.shopify.com/s/files/1/0430/1045/7753/files/48145408048.pdf
    • https://cdn.shopify.com/s/files/1/0431/4044/8407/files/rajuxirifurazoxesuwute.pdf
    • https://cdn.shopify.com/s/files/1/0438/0003/5485/files/85913789388.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/gizazuvolabemonixodokij.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/22511335110.pdf
    • https://cdn.shopify.com/s/files/1/0435/5073/6533/files/ge_profile_dishwasher_manual.pdf
    • https://cdn.shopify.com/s/files/1/0434/1674/8188/files/82113416922.pdf
    • https://cdn.shopify.com/s/files/1/0430/6799/8362/files/48303444604.pdf
    • https://cdn.shopify.com/s/files/1/0431/8894/5064/files/mowazigewapu.pdf
    • https://cdn.shopify.com/s/files/1/0428/0070/9791/files/nice_guidelines_antenatal_care_2020.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005492.bin
d9faf79724511b5017b0e4e8b3f62cc254764ff51fc78c284cc9e7a43484a4a3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5492 4192 bytes
font_01_sfnt_off00006337.bin
97272cfee2d3a0e51685d2aaa0199f235c7e84bf0f74284043513b7372f64123		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6337 5108 bytes
font_02_sfnt_off0000745d.bin
8fbdc57a7d03ec5d99e714dbb9efaa6b7b9222f3f6b7f4f72cd0ccea8b2ed68c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x745D 2020 bytes
font_03_sfnt_off00007db9.bin
d72b07da98e3af6b95616818b25e45af5900faa1307b19b7e0669586d4b11b1d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7DB9 10148 bytes
font_04_sfnt_off0000a037.bin
794d8cc090a449e0d460036171b2d5b2c749cb0dc3f17972c44626ada68ee3d8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA037 16168 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.