Malicious PDF — malware analysis report

Static analysis result for SHA-256 3530270b96253bad…

MALICIOUS

PDF

60.0 KB Created: 2020-09-01 08:40:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fdb210ec06a0c9c2b0ea4c299c42df41 SHA-1: 5eb47a422ce812a079b9eab2ded006c35538b928 SHA-256: 3530270b96253bad1da5f28fa766263a54e9d1a9d06b9f66d84c9def210e4243
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a significant number of embedded links, with a critical heuristic firing indicating a link farm pointing to malicious redirector infrastructure. The primary malicious URL identified is https://ttraff.ru/wix?keyword=hot-+dipped+galvanized+sheet+steel+%25E4%25B8%25AD%25E6%2596%2587. While the document body is heavily obfuscated, the presence of numerous links, including one to a known malicious redirector, strongly suggests a phishing or redirection attack. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=hot-+dipped+galvanized+sheet+steel+%25E4%25B8%25AD%25E6%2596%2587
    • https://cdn.shopify.com/s/files/1/0428/3419/8684/files/73072754080.pdf
    • https://cdn.shopify.com/s/files/1/0431/3733/5464/files/chicco_manual_breast_pump_video.pdf
    • https://cdn.shopify.com/s/files/1/0433/2421/1354/files/63247088862.pdf
    • https://cdn.shopify.com/s/files/1/0435/2271/9912/files/tuvewebez.pdf
    • https://cdn.shopify.com/s/files/1/0432/6483/5737/files/happy_birthday_jazz_piano_style.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/72593533024.pdf
    • https://cdn.shopify.com/s/files/1/0437/6159/8616/files/action_research_topics_in_education.pdf
    • https://cdn.shopify.com/s/files/1/0433/6710/4664/files/kenmore_dryers_manual.pdf
    • https://cdn.shopify.com/s/files/1/0435/9743/0941/files/97858668158.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/fofigez.pdf
    • https://cdn.shopify.com/s/files/1/0435/9208/9759/files/fortune_teller_template_meme.pdf
    • https://cdn.shopify.com/s/files/1/0435/6797/2513/files/64078531393.pdf
    • https://cdn.shopify.com/s/files/1/0430/6881/7569/files/jitaduxiledat.pdf
    • https://cdn.shopify.com/s/files/1/0434/4250/3832/files/53846891576.pdf
    • https://cdn.shopify.com/s/files/1/0433/4954/1017/files/caregiver_stress_and_burnout.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006dce.bin
5cbfd3527ea28002239154e539dc0950d93c01c6e615bc883c6f496e6369ccc6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6DCE 15872 bytes
font_01_sfnt_off0000a032.bin
96564aba911c042e1bbadff057d0b7705c7b68644d008025542afadf88f6d946		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA032 3112 bytes
font_02_sfnt_off0000ab37.bin
76e65a49edf69400f782ab24fc1c516bcb7994ca767d224954e0afe256aff5e7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAB37 5228 bytes
font_03_sfnt_off0000bd17.bin
90e9eacac29228ce25847b4f06835fa09f980a6e962836422be1e1d36576c6aa		 pdf-font-stream PDF embedded font (sfnt) at offset 0xBD17 10176 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.