Malicious PDF — malware analysis report

Static analysis result for SHA-256 36a09ad13dc9707a…

MALICIOUS

PDF

39.3 KB Created: 2020-08-01 06:19:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2de3c7516812d3f592f6c16f119c99f8 SHA-1: 63076c31cb7ab3f2a5f3b1d756352813a3b39550 SHA-256: 36a09ad13dc9707a7e91544ea7bd4b759a90614463425b0d8c8e0472febfb7fc
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links, constituting a link farm designed to attract search engine traffic. One of these links, https://ttraff.ru/pify?keyword=meteorite+armor+terraria, points to known malicious redirector infrastructure. The ML classifier also strongly indicated maliciousness. No scripts were extracted, and the document body was heavily obfuscated, but the link farm and redirector are strong indicators of a malicious distribution or redirection scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=meteorite+armor+terraria
    • http://files.grandmaceilshouse.com/uploads/1/3/1/4/131408529/92347f03614c5.pdf
    • http://files.arespta.org/uploads/1/3/1/1/131163492/2c9d599caaa2a5.pdf
    • http://files.fertilityafter40.com/uploads/1/3/0/8/130814346/9704661.pdf
    • http://files.susdorchestras.com/uploads/1/3/1/3/131383949/morus_zagijivedebus_wufutatubud_fodogot.pdf
    • http://files.ladyvpoetry.com/uploads/1/3/2/6/132683267/4a4fbb9.pdf
    • https://cdn.shopify.com/s/files/1/0433/2729/1542/files/kudotekovoxalamerewonop.pdf
    • https://cdn.shopify.com/s/files/1/0433/7618/1404/files/darujerebe.pdf
    • https://cdn.shopify.com/s/files/1/0434/5652/8537/files/13106245723.pdf
    • https://cdn.shopify.com/s/files/1/0435/8239/0431/files/josixavadezalagur.pdf
    • https://cdn.shopify.com/s/files/1/0431/2412/9952/files/wunuwiwafufefag.pdf
    • https://cdn.shopify.com/s/files/1/0430/9945/5642/files/17967688814.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/zaduvezumutup.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/61066914906.pdf
    • https://cdn.shopify.com/s/files/1/0434/0908/0477/files/misuvosefu.pdf
    • https://cdn.shopify.com/s/files/1/0430/7815/6449/files/24155550456.pdf
    • https://cdn.shopify.com/s/files/1/0429/9299/2410/files/zowez.pdf
    • https://cdn.shopify.com/s/files/1/0428/1604/5222/files/vojujupomufimoxonexamuwu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005df6.bin
e909d8389a6581fef8f6b36b14a34a77b01411da01eeda88fc7df1d5a7c40008		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5DF6 4624 bytes
font_01_sfnt_off00006da2.bin
d1233d2c0891ad26054a1b7a94db5c5fa90e5a50f10c3ee2dd9278ce1b1ef2df		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6DA2 10260 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.