Malicious PDF — malware analysis report

Static analysis result for SHA-256 2077f7b1710c1e5a…

MALICIOUS

PDF

43.0 KB Created: 2020-08-29 01:06:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a1b42b1f09c3806d3aea6a6c893c675a SHA-1: 7b185bbe1e3c87ce9c629d28a1420d2b54c50762 SHA-256: 2077f7b1710c1e5af4b5717ca9a73285fc876752224b82c180f36801f7c61620
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a malicious redirector link disguised as a search result for 'Robert lang origami pdf'. This link, https://ttraff.ru/wix?keyword=robert+lang+origami+pdf, is designed to lead users to further malicious content. The document also exhibits characteristics of a link farm, with numerous embedded links, many pointing to benign Shopify domains, likely for SEO manipulation. The ML classifier strongly indicates malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=robert+lang+origami+pdf
    • https://cdn.shopify.com/s/files/1/0432/1122/7300/files/popawipekuveze.pdf
    • https://cdn.shopify.com/s/files/1/0440/9622/5432/files/zodizetoval.pdf
    • https://cdn.shopify.com/s/files/1/0431/2514/5754/files/widokadivizonazagofe.pdf
    • https://cdn.shopify.com/s/files/1/0432/3573/7755/files/pictionary_cards_easy.pdf
    • https://cdn.shopify.com/s/files/1/0436/1378/2173/files/dibupogegisimuxujofaxu.pdf
    • https://cdn.shopify.com/s/files/1/0428/5572/7260/files/33252011575.pdf
    • https://cdn.shopify.com/s/files/1/0430/6770/3457/files/askerlik_kanunu_2020.pdf
    • https://cdn.shopify.com/s/files/1/0430/8484/1124/files/24008775700.pdf
    • https://cdn.shopify.com/s/files/1/0451/0197/3657/files/ms_university_baroda_admission_form.pdf
    • https://static.usrfiles.com/ugd/b8c837_5e80d4d8a8b74db684bbff4843c84d89.pdf
    • https://static.usrfiles.com/ugd/b8c837_760f2e9d855641ee95ef767bd6cd136c.pdf
    • https://static.usrfiles.com/ugd/b8c837_80c09b72ba0a440abe4c978e1794a1c5.pdf
    • https://static.usrfiles.com/ugd/b8c837_a549923e13cf4248b8a2f4a604685c78.pdf
    • https://static.usrfiles.com/ugd/b8c837_f7611be48a7a4df19e2892168bd938e0.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006a59.bin
b28e1c969edf1f77e0477862c323f073b8e14729483ffdea5b8e8aecb5fd0f25		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6A59 5328 bytes
font_01_sfnt_off00007c5f.bin
7d4ac5ef34f7eb635f7b113373b05031876be98ac0fe77d23e743d64bbdcffae		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7C5F 10156 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.