Malicious PDF — malware analysis report

Static analysis result for SHA-256 38dab08f79d38edf…

MALICIOUS

PDF

41.1 KB Created: 2020-09-05 11:43:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ccc2b4d1f0f6f69bfb9fc209dde22819 SHA-1: b87bbbc20433feb6641e679075c2936f0751f60c SHA-256: 38dab08f79d38edfa30c362221a87dea3c211070d31455b2b49c6ef110edd3a3
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a link to a known malicious redirector, disguised as interview tips. The ML classifier strongly indicated maliciousness. The document body, though partially corrupted, contains the URL and suggests a lure related to interview preparation. The presence of numerous external links, many pointing to Shopify, indicates a link farm strategy, likely to obscure the final malicious destination.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/wix?keyword=tips+for+answering+behavioral+interview+questions
    • https://cdn.shopify.com/s/files/1/0455/7858/4229/files/free_back_to_school_banner_template.pdf
    • https://cdn.shopify.com/s/files/1/0438/8726/3899/files/kurrimine_beach_fishing_report.pdf
    • https://cdn.shopify.com/s/files/1/0432/3672/0808/files/fulipegolamexogagovet.pdf
    • https://static.usrfiles.com/ugd/3bca44_fe7f07a82bcf4d23ad6164b7a979bc41.pdf
    • https://static.usrfiles.com/ugd/bf650e_1740434e44b04609a49af02a02dff271.pdf
    • https://static.usrfiles.com/ugd/80c1db_fa0d863040574325bc225ba313056df2.pdf
    • https://static.usrfiles.com/ugd/a382ee_c6c35d48824843ac9e12a9c515359594.pdf
    • https://static.usrfiles.com/ugd/cc089a_e617e94e4d334754a83f2d2a21655203.pdf
    • https://cdn.shopify.com/s/files/1/0435/3287/7976/files/43996463988.pdf
    • https://cdn.shopify.com/s/files/1/0430/3192/0794/files/official_gre_verbal_reasoning_practice_questions_download.pdf
    • https://cdn.shopify.com/s/files/1/0431/1564/3042/files/the_new_real_book_download.pdf
    • https://cdn.shopify.com/s/files/1/0434/0993/2439/files/general_belongingness_scale.pdf
    • https://cdn.shopify.com/s/files/1/0430/7009/5521/files/mipekew.pdf
    • https://static.usrfiles.com/ugd/ecec20_c6a6a4130dab45499b3fd9cbbaa355ef.pdf
    • https://static.usrfiles.com/ugd/81b904_f7272c8553024b54b91ab1ded61e5e46.pdf
    • https://static.usrfiles.com/ugd/b8c837_45bbcf50317944e9922dec9d260c78bc.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000061c4.bin
ac0f11168e5ab8a3a1cb5b9eb4a017da874e217033ea3bb681039b326d8d83b7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x61C4 5532 bytes
font_01_sfnt_off000074a5.bin
78677bd5600964b5897b9bef0e9454fcbcd14c20cec6a2b782bace7022edc2d0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x74A5 10204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.