Malicious PDF — malware analysis report

Static analysis result for SHA-256 2dfc5321db2bc42e…

MALICIOUS

PDF

55.7 KB Created: 2020-10-20 01:58:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fc9b36b690ef457b89b9aecdce78a723 SHA-1: 2355081decd9642c6c9ef27b92810e8235857a2d SHA-256: 2dfc5321db2bc42ebb3b9997e846c87198b3b3270b5b459d0149433586a15c66
152 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.002 Spearphishing Attachment

This PDF file was flagged as malicious by an ML classifier and contains a critical heuristic indicating a link to known malicious redirector infrastructure. The embedded URL `https://ttraff.me/123?keyword=li%25C3%25AAn+qu%25C3%25A2n+%25E1%25BA%25A5n+%25C4%2591%25E1%25BB%2599+apk+2020` is the primary indicator of malicious intent. The document also contains a large number of links to `uploads.strikinglycdn.com`, suggesting a link farm or SEO poisoning attempt to distribute malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/123?keyword=li%25C3%25AAn+qu%25C3%25A2n+%25E1%25BA%25A5n+%25C4%2591%25E1%25BB%2599+apk+2020
    • https://xivenisulebitok.weebly.com/uploads/1/3/1/3/131378814/tozolab_wunubolowu_lewafiz_rafuwam.pdf
    • https://xalipifizipig.weebly.com/uploads/1/3/1/3/131379045/totenowawuni.pdf
    • https://cdn-cms.f-static.net/uploads/4368756/normal_5f880af16769a.pdf
    • https://cdn-cms.f-static.net/uploads/4368991/normal_5f8bd332a52c7.pdf
    • https://cdn-cms.f-static.net/uploads/4373304/normal_5f8a0e5b2b66d.pdf
    • https://uploads.strikinglycdn.com/files/83551365-74a7-4fba-9129-aecec0bf0844/82542466515.pdf
    • https://uploads.strikinglycdn.com/files/5438aeb7-5981-469e-9415-1a204a922e8b/sapuko.pdf
    • https://uploads.strikinglycdn.com/files/dc9af8e5-d950-4be1-9872-c1191da1ca4c/movaxonafi.pdf
    • https://uploads.strikinglycdn.com/files/331f2cb4-6192-4b4b-8f4d-0f99b45dedec/bufisigovipojivakevunoja.pdf
    • https://uploads.strikinglycdn.com/files/19a34332-8fa1-425d-b1ce-afd368c80275/5040832113.pdf
    • https://uploads.strikinglycdn.com/files/76ea0b8d-34b6-475c-b671-81f0930d9232/norulixawexagojuzubenemu.pdf
    • https://uploads.strikinglycdn.com/files/c2e94cb8-4a9b-4c1a-a4d3-cd405a51c0c9/gafugoloxofamoxeda.pdf
    • https://uploads.strikinglycdn.com/files/ea2bf61a-4f89-456b-987f-b67a769ae34d/degerejutoferulumadar.pdf
    • https://uploads.strikinglycdn.com/files/7abeb8b7-b3c4-4114-99cd-1238c33be6a3/kaxerenigatusoner.pdf
    • https://cdn.shopify.com/s/files/1/0433/2044/3045/files/ffxiv_mining_guide_1-70.pdf
    • https://cdn.shopify.com/s/files/1/0437/6035/3429/files/volvamos_a_la_fuente.pdf
    • https://cdn.shopify.com/s/files/1/0435/8812/4830/files/rahway_river_park_picnic_area.pdf
    • https://cdn.shopify.com/s/files/1/0268/8054/0858/files/dizonodudewa.pdf
    • https://cdn.shopify.com/s/files/1/0438/4161/8082/files/manual_honda_cb_250_twister_2020_espaol.pdf
    • https://cdn.shopify.com/s/files/1/0505/4919/4917/files/best_photo_edit_app_android.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000089d8.bin
8324e3e8c61cd3ebfac6e2c0a48189975705f2026165b75c043317bde322bc28		 pdf-font-stream PDF embedded font (sfnt) at offset 0x89D8 5880 bytes
font_01_sfnt_off00009c24.bin
3fd2ff29ad045e3a91fa49eac9f2a1ad03bbd4c73fae11d0973385d38de7bc81		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9C24 23928 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.