Malicious PDF — malware analysis report

Static analysis result for SHA-256 3951f7d0ad48ea0b…

MALICIOUS

PDF

62.8 KB Created: 2020-08-14 14:32:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 242dfa8e33044b864c73f2dcb0f10a40 SHA-1: a226d24f2f27ebf020340bb9298fb4fb1a4a93ac SHA-256: 3951f7d0ad48ea0b994556e589963d1f454a0abc0278d93c284d4088049f95cb
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a malicious redirector link pointing to 'ttraff.ru' which is associated with a steam link lure. The document also functions as a link farm, containing numerous links to other PDFs, likely for SEO manipulation or to distribute further malicious content. The ML classifier strongly flagged this PDF as malicious, supporting the presence of malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=steam+link+beta+apkpure
    • http://files.myadolessons.com/uploads/1/3/1/3/131381799/2441557.pdf
    • http://nariniz.romuloolazo.com/uploads/1/3/1/6/131636612/nepora_winozovepitig.pdf
    • http://nabowaro.snohomishyouthvolleyball.org/uploads/1/3/2/6/132696212/02d0dbd8e.pdf
    • http://files.5ivezero.com/uploads/1/3/1/4/131437538/boxuzuzege-jamov-susaxozokusonir.pdf
    • https://cdn.shopify.com/s/files/1/0429/6222/3263/files/ripaka.pdf
    • https://cdn.shopify.com/s/files/1/0437/6916/8021/files/16467516654.pdf
    • https://cdn.shopify.com/s/files/1/0433/7873/7302/files/possessive_pronoun_exercise.pdf
    • https://cdn.shopify.com/s/files/1/0433/2794/6904/files/kupew.pdf
    • https://cdn.shopify.com/s/files/1/0436/0467/2675/files/74040366804.pdf
    • https://cdn.shopify.com/s/files/1/0427/6997/3415/files/barrier_free_design.pdf
    • https://cdn.shopify.com/s/files/1/0436/3550/7358/files/anlise_do_contedo_bardin.pdf
    • https://cdn.shopify.com/s/files/1/0432/4940/2024/files/xemuxusuditineza.pdf
    • https://cdn.shopify.com/s/files/1/0429/2873/4367/files/gelonijejerezejatusavarol.pdf
    • https://cdn.shopify.com/s/files/1/0436/0096/9890/files/41247698947.pdf
    • https://cdn.shopify.com/s/files/1/0435/6761/2063/files/91019599456.pdf
    • https://cdn.shopify.com/s/files/1/0434/4135/6950/files/jodijisedowelipepibimajox.pdf
    • https://cdn.shopify.com/s/files/1/0430/0403/5221/files/sekijatujamopajuluneki.pdf
    • https://cdn.shopify.com/s/files/1/0433/6363/1272/files/45959399448.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/pegegezanonipilupe.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/pegegezanoni

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005deb.bin
c4ea3b2b31ffd278b4a7eca3de92e59a082a069ef0de5e646a4f75fcda393e45		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5DEB 21628 bytes
font_01_sfnt_off0000a1a8.bin
095bd9b00c953a53735b38a64c8c0714b96776ea89c9914104b14fd5ae70e607		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA1A8 5092 bytes
font_02_sfnt_off0000b2e0.bin
7d25801e97e01f4fb7cf848a1f759d20067fff0e5eb00d3d2aadc88c5466c435		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB2E0 11372 bytes
font_03_sfnt_off0000d820.bin
fb2fc76d2543962a218d25a88f370a2cd7e9f0ec7b2bada209548f03e17e6a50		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD820 16264 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.