Malicious PDF — malware analysis report

Static analysis result for SHA-256 2b76ea1426488bb1…

MALICIOUS

PDF

49.4 KB Created: 2020-08-23 16:20:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d63487f5818f837cd0254f04a474abae SHA-1: 84cc5a9436d022a7f690d030ac784593b6223e74 SHA-256: 2b76ea1426488bb1f1293c32e04273e90b067acbc7819ae798362123190e944e
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links, many of which point to external resources. One critical heuristic identified a link to known malicious redirector infrastructure, specifically 'https://ttraff.cc/pify?keyword=anatomy+3d+organs+apk'. The document body also contains this URL, suggesting it is the primary lure. The presence of numerous PDF links, many hosted on cdn.shopify.com, indicates a link farm designed to improve search engine ranking for malicious content. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=anatomy+3d+organs+apk
    • http://bavasu.totsandco.org/uploads/1/3/0/7/130776089/zuwir-gilatewil-sisas-fajid.pdf
    • http://denisukuv.shooplr.com/uploads/1/3/1/3/131383314/mipobatol_pijike.pdf
    • http://kanofuf.uniontownartclub.org/uploads/1/3/0/7/130739974/c38b0dcec15636.pdf
    • http://zumip.bethelchurchofchrist.org/uploads/1/3/2/8/132815787/wamaveworitu_kigez_zibega.pdf
    • http://files.inyfilmfest.com/uploads/1/3/1/4/131453605/91b5a6ccfa31.pdf
    • https://cdn.shopify.com/s/files/1/0433/3692/5342/files/dujajum.pdf
    • https://cdn.shopify.com/s/files/1/0434/6337/7048/files/sisubomotoxazeditenekewad.pdf
    • https://cdn.shopify.com/s/files/1/0431/5627/5362/files/functional_areas_of_business.pdf
    • https://cdn.shopify.com/s/files/1/0432/8072/8224/files/rabuzajuderez.pdf
    • https://cdn.shopify.com/s/files/1/0435/6967/6451/files/guidelines_for_treatment_of_asthma_in_pediatrics.pdf
    • https://cdn.shopify.com/s/files/1/0431/0931/8813/files/backplane_bus_system.pdf
    • https://cdn.shopify.com/s/files/1/0431/5430/9284/files/taparugidobaxegajokijuw.pdf
    • https://cdn.shopify.com/s/files/1/0431/1813/3405/files/kefakudivufabaf.pdf
    • https://cdn.shopify.com/s/files/1/0432/8115/4198/files/wepefosedofegojodar.pdf
    • https://cdn.shopify.com/s/files/1/0430/0210/1923/files/julufuwepafu.pdf
    • https://cdn.shopify.com/s/files/1/0457/9439/4278/files/kamen_rider_build_episode_40_anoboy.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000577d.bin
ba356ed6fe076fb3a1da86a64c359b65ff6e56f760d48d188c3b30bff0c242e0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x577D 5868 bytes
font_01_sfnt_off00006bb1.bin
748f4445b6d478a1d7466e3e37ff79f4f0687ff3f4f4b2751df13ab7c8786cd5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6BB1 5568 bytes
font_02_sfnt_off00007e97.bin
10a6262e41583f79708edde9c61a08710dfeb2cd43b3475c4e136bd840ba1ae1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7E97 11396 bytes
font_03_sfnt_off0000a359.bin
e9fe716c2abc985b12a899a49d5539e4e8be1b56d50c083b30290d85a2a7c848		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA359 16092 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.