Malicious PDF — malware analysis report

Static analysis result for SHA-256 3621a7b22fe0a13d…

MALICIOUS

PDF

41.3 KB Created: 2020-09-01 05:09:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9ab7e36cb6402db6f50b81d06377c4d1 SHA-1: 1445ef6c67e07f8b9697b0e9dd6f03ea3f3674ec SHA-256: 3621a7b22fe0a13da4e566d42fb390b6a7d6941bdd1d868bf39243492e956aec
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a critical heuristic firing for a malicious redirector link, specifically pointing to 'https://ttraff.link/wix?keyword=sensacion+languidez+estomago'. Additionally, it exhibits characteristics of a PDF link farm, with numerous embedded URLs, one of which is 'https://cdn.shopify.com/s/files/1/0436/7525/4937/files/local_literature_about_tardiness_of_students_in_the_philippines.pdf'. The ML classifier also strongly flagged this PDF as malicious. No scripts were extracted, but the presence of these malicious links indicates a likely phishing or redirection attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/wix?keyword=sensacion+languidez+estomago
    • https://cdn.shopify.com/s/files/1/0436/7525/4937/files/local_literature_about_tardiness_of_students_in_the_philippines.pdf
    • https://cdn.shopify.com/s/files/1/0433/7182/3262/files/bikini_body_guide_workouts.pdf
    • https://cdn.shopify.com/s/files/1/0427/6856/4380/files/switzerland_crs_reporting_countries.pdf
    • https://static.usrfiles.com/ugd/26481d_c260c060ca1641f9b0e508b9096eb601.pdf
    • https://static.usrfiles.com/ugd/4d400c_aebad64957434d9c9fa3e1a3b2a275da.pdf
    • https://cdn.shopify.com/s/files/1/0435/2924/0727/files/29029272207.pdf
    • https://cdn.shopify.com/s/files/1/0432/2417/0664/files/investigation_7._2_gravimetric_stoichiometry_lab_answers.pdf
    • https://static.usrfiles.com/ugd/eed56f_2576b9c4b9e64bc799d2593be9646117.pdf
    • https://static.usrfiles.com/ugd/b444d4_6d511f3b9b22412792348afcac1860ff.pdf
    • https://static.usrfiles.com/ugd/299074_b791e08644bc47b7a63a7ccb62ae635e.pdf
    • https://static.usrfiles.com/ugd/ff2e72_93078869a3224391b69cca3ecbbf1b10.pdf
    • https://static.usrfiles.com/ugd/e3ff21_52765bf3758e4c67b8888bd45cf204a2.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000611d.bin
2378486ece62b266493479124011f429ad13d82c224c119c4d75ab0618010e8e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x611D 5316 bytes
font_01_sfnt_off00007325.bin
5f747a775151448b63030eba74ab91fffc624a56d6cb7f2848f4bebcaf1161d2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7325 11112 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.