Malicious PDF — malware analysis report

Static analysis result for SHA-256 2707a456ee2697fe…

MALICIOUS

PDF

55.8 KB Created: 2020-08-05 06:22:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 263984440244142d9296213828c7dfbf SHA-1: 4a59364e510d6574560d3fc1fa3723730d36dd12 SHA-256: 2707a456ee2697fe1ed5e97fa1b79e62108ceb99e4dd2b33730246c5c5c56814
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links, many of which point to a link farm hosted on Shopify. One of these links, https://ttraff.ru/pify?keyword=lab+equipment+worksheet+answers+pdf, is identified as a malicious redirector. The document body, though heavily obfuscated, also contains this URL, suggesting the primary intent is to redirect the user to malicious infrastructure. The ML classifier strongly supports the malicious nature of this PDF.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=lab+equipment+worksheet+answers+pdf
    • http://files.umbrellaville.com/uploads/1/3/1/6/131637374/7143080.pdf
    • http://files.openheartstudio.org/uploads/1/3/0/7/130776208/5649029.pdf
    • http://files.theconsiderateusa.com/uploads/1/3/0/7/130775677/8b2537.pdf
    • http://files.ocmsmedicaljobs.org/uploads/1/3/1/4/131408899/wurisusovo-lunirikav.pdf
    • https://cdn.shopify.com/s/files/1/0427/6033/9623/files/46045090027.pdf
    • https://cdn.shopify.com/s/files/1/0431/7757/4562/files/getokiboxefifox.pdf
    • https://cdn.shopify.com/s/files/1/0428/6388/6495/files/the_prince_machiavelli.pdf
    • https://cdn.shopify.com/s/files/1/0433/6612/1623/files/kojupugumegodamudota.pdf
    • https://cdn.shopify.com/s/files/1/0438/2988/7136/files/siwerezemumiwepularupa.pdf
    • https://cdn.shopify.com/s/files/1/0429/7749/3146/files/paluxelob.pdf
    • https://cdn.shopify.com/s/files/1/0429/8499/7025/files/94812735823.pdf
    • https://cdn.shopify.com/s/files/1/0433/1097/3083/files/16408459453.pdf
    • https://cdn.shopify.com/s/files/1/0430/0436/2906/files/45142373060.pdf
    • https://cdn.shopify.com/s/files/1/0428/9763/7535/files/43633693587.pdf
    • https://cdn.shopify.com/s/files/1/0432/6745/7182/files/kinumixik.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000731d.bin
c571c324a7a126433ab01f00611227585c7dd270ce5dffa6b6a22994d6de7ba2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x731D 5612 bytes
font_01_sfnt_off00008617.bin
40ef96da86b6123d577d475be460de15c41b9ca7393a8e650be4e9942aa3c64b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8617 3720 bytes
font_02_sfnt_off00009178.bin
d20d802787d8187f823b4260a491d770aecf3dbf10849fc51828ab3b9996d8e6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9178 9568 bytes
font_03_sfnt_off0000b256.bin
628a04c91c72dcc5c0a308f14421b04d4fb1ad24b84d3aaf7cc667da5b7abbf4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB256 9732 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.