Malicious PDF — malware analysis report

Static analysis result for SHA-256 2836a9d3a2dc0de4…

MALICIOUS

PDF

39.8 KB Created: 2020-08-29 09:25:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ac84c8907cc30ac10ad06754c8358aaa SHA-1: 697ff6d7edd258fbfacfde0ddbe01ba084d217e5 SHA-256: 2836a9d3a2dc0de4d584c3519a323b4425d465de30e51c8b4a5c4bb081fb468b
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a heuristic firing for a malicious redirector link, which points to `https://ttraff.cc/wix?keyword=primeiro+molar+inferior`. This URL is likely used to redirect the user to a malicious site. The document body, though heavily obfuscated, also contains this URL, suggesting it's the primary lure. The presence of numerous other PDF links, many hosted on Shopify, indicates a potential link farm or SEO poisoning attempt to distribute the malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=primeiro+molar+inferior
    • https://static.usrfiles.com/ugd/b8c837_aa43855117d7412ab7489465ef3d455e.pdf
    • https://static.usrfiles.com/ugd/b8c837_81f0f8a7ee9a4b09afe8635dd88fd0f8.pdf
    • https://static.usrfiles.com/ugd/b8c837_a90dd225c32e41e8af431106ff17fda3.pdf
    • https://static.usrfiles.com/ugd/b8c837_fc230a8c88da4196b4663558725cd998.pdf
    • https://static.usrfiles.com/ugd/b8c837_92b238685ffe4f349a7145b17cc66dab.pdf
    • https://static.usrfiles.com/ugd/b8c837_f1b3ac8fb842418daf1770bc38d386a9.pdf
    • https://static.usrfiles.com/ugd/b8c837_3d3eb8c9cf294477bd1a2e232c109eff.pdf
    • https://cdn.shopify.com/s/files/1/0430/7956/5465/files/poultry_production_in_the_philippines.pdf
    • https://cdn.shopify.com/s/files/1/0433/4393/7690/files/90961245056.pdf
    • https://cdn.shopify.com/s/files/1/0440/6591/5032/files/miranda_valles_tilted_kilt.pdf
    • https://cdn.shopify.com/s/files/1/0431/3006/0955/files/fudalegawewulimesiwapabe.pdf
    • https://cdn.shopify.com/s/files/1/0464/8294/8264/files/rotikimofefojewalegowazu.pdf
    • https://cdn.shopify.com/s/files/1/0437/4996/5985/files/vedafozirukurovamuwane.pdf
    • https://cdn.shopify.com/s/files/1/0431/6856/3355/files/41271885914.pdf
    • https://cdn.shopify.com/s/files/1/0431/1898/5370/files/astaghfar_ki_fazilat.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005ec9.bin
7db50d9ecc7bd26921b8b71db3e7890a301a1bee7e87392bcf07c8c269925525		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5EC9 4736 bytes
font_01_sfnt_off00006ec0.bin
02ac5029ae857da3499bc2a58a184accc19f51cb2a2626827c5f5368b9c43796		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6EC0 10472 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.