Malicious PDF — malware analysis report

Static analysis result for SHA-256 218fdd72afe107d0…

MALICIOUS

PDF

74.6 KB Created: 2020-08-12 18:56:24 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e664e48f7e7157062205ff2c55665bb9 SHA-1: cfe67c6660a68b7c753f11a8f692d2e89dacb878 SHA-256: 218fdd72afe107d0afd2ddb860f6163a6f20f95e9864cae9b45f4b862002003c
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains numerous embedded links, with a critical heuristic firing for a malicious redirector. The primary malicious URL identified is https://ttraff.com/pify?keyword=basal+ganglia+structure+and+function+pdf, which is likely used to redirect users to further malicious content. The document body, though heavily obfuscated, contains this URL, reinforcing its role in the attack. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=basal+ganglia+structure+and+function+pdf
    • http://jogoxosin.coaching-pearlmoments.com/uploads/1/3/0/7/130738720/9382491.pdf
    • http://files.margaretglaeser.com/uploads/1/3/1/4/131438427/robogefago-genozaxosun-bijel.pdf
    • http://files.philippecorriveau.com/uploads/1/3/0/7/130775676/dbd5c71fdc1e4.pdf
    • http://files.blazingbronzesetters.com/uploads/1/3/1/6/131606550/gefosonumafufuf.pdf
    • https://cdn.shopify.com/s/files/1/0439/0138/6920/files/kasogatizejuvolad.pdf
    • https://cdn.shopify.com/s/files/1/0438/9906/0392/files/sickle_cell_anemia_who.pdf
    • https://cdn.shopify.com/s/files/1/0434/5207/2086/files/zazunovomafatapodubo.pdf
    • https://cdn.shopify.com/s/files/1/0435/1941/0335/files/76459160518.pdf
    • https://cdn.shopify.com/s/files/1/0433/4891/8440/files/31315429799.pdf
    • https://cdn.shopify.com/s/files/1/0430/0311/7721/files/brand_marketing_strategies.pdf
    • https://cdn.shopify.com/s/files/1/0433/4478/9669/files/vuxeduvor.pdf
    • https://cdn.shopify.com/s/files/1/0435/2190/0696/files/.pdf
    • https://cdn.shopify.com/s/files/1/0435/2930/6272/files/85796470758.pdf
    • https://cdn.shopify.com/s/files/1/0430/4207/8877/files/36640337621.pdf
    • https://cdn.shopify.com/s/files/1/0432/7679/6057/files/vurapuwikix.pdf
    • https://cdn.shopify.com/s/files/1/0436/9252/3675/files/cbrn_usmc.pdf
    • https://cdn.shopify.com/s/files/1/0438/3725/9938/files/tubufurejizisuji.pdf
    • https://cdn.shopify.com/s/files/1/0430/2631/7473/files/kalemigegotujiliduki.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d7e9.bin
cb7fc0cfcedc2e849a60aa74b68db8cb8c74030aca8bbc1e7dffa5207cf398e0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD7E9 5256 bytes
font_01_sfnt_off0000e9cc.bin
7e931ee1a28ce0e7b3db7b9f71323644e024c3e3e985830e44982c76057bc195		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE9CC 11052 bytes
font_02_sfnt_off00010e4d.bin
1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10E4D 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.