Malicious PDF — malware analysis report

Static analysis result for SHA-256 24166ab06e7b5279…

MALICIOUS

PDF

41.2 KB Created: 2020-08-25 23:00:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 270e0d132dda131081e099dbd64b0ebf SHA-1: e638bbc0c3d10663534fcaf609e10f3e9c116128 SHA-256: 24166ab06e7b5279853122c0c537e8be3d9cf4089f0d9794e88ea74e74b4226d
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains numerous links, including one pointing to a known malicious redirector at 'https://ttraff.ru/pify?keyword=como+dobrar+uma+folha+a1'. The document body, though heavily obfuscated, also contains this URL, suggesting an attempt to lure users to malicious infrastructure. The presence of a PDF link farm further supports a malicious intent, likely for SEO poisoning or traffic generation to the redirector.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=como+dobrar+uma+folha+a1
    • http://files.zwrestletalk.com/uploads/1/3/1/6/131607600/gokavojinosi-mijadojajifasa.pdf
    • http://fodexa.perchancetheatre.com/uploads/1/3/1/3/131384600/a803713e2fb1d8.pdf
    • http://kibiwud.masom.net/uploads/1/3/0/9/130969679/jobogon.pdf
    • https://cdn.shopify.com/s/files/1/0432/7407/6315/files/red_sea_rules_study_guide.pdf
    • https://cdn.shopify.com/s/files/1/0430/8926/4794/files/analytical_reasoning_questions_and_answers_with_explanation_download.pdf
    • https://cdn.shopify.com/s/files/1/0432/7617/3472/files/chrome_browser_standalone.pdf
    • https://cdn.shopify.com/s/files/1/0447/5689/3847/files/autobuska_stanica_nis_red_voznje.pdf
    • https://cdn.shopify.com/s/files/1/0434/3057/6285/files/sample_of_acknowledgement_letter_for_narrative_report.pdf
    • https://cdn.shopify.com/s/files/1/0431/0954/8188/files/99028916420.pdf
    • https://cdn.shopify.com/s/files/1/0430/2965/9797/files/naxejavowij.pdf
    • https://cdn.shopify.com/s/files/1/0435/7927/7467/files/1894713646.pdf
    • https://cdn.shopify.com/s/files/1/0462/5802/8693/files/97273623024.pdf
    • https://cdn.shopify.com/s/files/1/0432/9255/7467/files/90357248409.pdf
    • https://cdn.shopify.com/s/files/1/0434/4460/0999/files/48001716838.pdf
    • https://cdn.shopify.com/s/files/1/0448/2488/7456/files/bilangan_rasional.pdf
    • https://cdn.shopify.com/s/files/1/0434/2749/6087/files/downtown_baltimore_map.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://cdn.shopify.com/s/files/1

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005de9.bin
f7381f2ce34f4dbe2d184a4cd9dc53bee495697f9fa9538d0d433e8f6b04ef8d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5DE9 5068 bytes
font_01_sfnt_off00006f05.bin
6f2646c41355c73f119c92916efea26b1e836ce46777cf0c07d34ba0a15c4ab5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6F05 13168 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.