Malicious PDF — malware analysis report

Static analysis result for SHA-256 3256c2c7dda5cb26…

MALICIOUS

PDF

53.4 KB Created: 2020-09-02 18:50:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9c890157b2d17362df9c61461a898d43 SHA-1: 3651a0f1cf1f9e991cf287fc18808e37bedcf8fd SHA-256: 3256c2c7dda5cb26774961d93229fa463793d8e6abcf0d2d2d15d79f6e5c8673
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.cc/pify?keyword=outlook+2013+manual+archive+does+not+work'. This URL is likely used to redirect the user to a malicious site. The document also contains a large number of embedded links, many hosted on shopify.com, which is flagged as a PDF link farm. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=outlook+2013+manual+archive+does+not+work
    • https://cdn.shopify.com/s/files/1/0431/7573/9553/files/yuna_crush_lyrics.pdf
    • https://cdn.shopify.com/s/files/1/0438/7382/9032/files/monotype_sample_teams.pdf
    • https://cdn.shopify.com/s/files/1/0428/9832/5663/files/jozobikaladonaf.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/3785448733.pdf
    • https://cdn.shopify.com/s/files/1/0462/7221/7237/files/dakutupofasaxu.pdf
    • https://static.usrfiles.com/ugd/3e5d97_78e1f6ce866d4af882cdb7e02b840db7.pdf
    • https://static.usrfiles.com/ugd/b8c837_ab181c78135d41809a4d3d37dd25602a.pdf
    • https://static.usrfiles.com/ugd/b371d9_68e82ecb7c2c481c99ddb24f8fc06319.pdf
    • https://cdn.shopify.com/s/files/1/0434/5351/3893/files/26126894392.pdf
    • https://cdn.shopify.com/s/files/1/0437/8922/2037/files/checkpoint_datasheet_12600.pdf
    • https://static.usrfiles.com/ugd/93971e_50b32bd4ba0e4630ad1bb228f546279c.pdf
    • https://static.usrfiles.com/ugd/eeb7bd_73b9d7a4e9284c2faa58c3e922747f80.pdf
    • https://static.usrfiles.com/ugd/0dcf4b_9839b313b1d4459cb67569532b64153a.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00009208.bin
7ac3812a0859cdab30b96d38554a75ba568fd96ac92727d19ce7d125f4494d48		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9208 5912 bytes
font_01_sfnt_off0000a615.bin
2c9d7808a94c63fdb8483c1ec6877eb9c29014f18187d5684ca398c500e900f5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA615 10192 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.