Malicious PDF — malware analysis report

Static analysis result for SHA-256 39e24367c536932d…

MALICIOUS

PDF

45.9 KB Created: 2020-09-02 15:41:19 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a0f0421155dc381a0f0c25ea2009231c SHA-1: 77c23f9e144ab1281be3ea380065ce5b44dea798 SHA-256: 39e24367c536932d48c062cf470029b21ad9130f206d6cc108294cc552083f68
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a heuristic firing for PDF_MALICIOUS_REDIRECTOR_LINK, indicating it points to malicious infrastructure. Additionally, PDF_SEO_LINK_FARM indicates a large number of embedded links, with the primary malicious URL being ttraff.ru. The ML classifier also strongly flagged this PDF as malicious. The document body, though partially corrupted, contains the URL and a title suggesting a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=funny+notification+sounds+for+text+messages
    • https://cdn.shopify.com/s/files/1/0431/3510/7233/files/3978118488.pdf
    • https://cdn.shopify.com/s/files/1/0461/4435/6515/files/modern_platform_bed_king_wood.pdf
    • https://cdn.shopify.com/s/files/1/0435/7275/6648/files/blonde_squad_2018.pdf
    • https://cdn.shopify.com/s/files/1/0433/9302/4158/files/incident_report_email_format.pdf
    • https://cdn.shopify.com/s/files/1/0428/1312/8867/files/55183095856.pdf
    • https://static.usrfiles.com/ugd/a31856_4dbfba7c54844f318e2f8095fc4bd098.pdf
    • https://static.usrfiles.com/ugd/735189_3034d95f9f06432a878a4efc37063f76.pdf
    • https://cdn.shopify.com/s/files/1/0434/0600/0282/files/imaginative_writing_burroway.pdf
    • https://cdn.shopify.com/s/files/1/0437/1388/8405/files/70611499582.pdf
    • https://cdn.shopify.com/s/files/1/0466/7300/2661/files/boy_hairstyle_image_hd.pdf
    • https://cdn.shopify.com/s/files/1/0431/0407/5933/files/97952433025.pdf
    • https://cdn.shopify.com/s/files/1/0460/1344/8353/files/logik_washing_machine_l712wm13_e30.pdf
    • https://cdn.shopify.com/s/files/1/0431/0990/8642/files/pense_e_enriquea_audiobook_gratis.pdf
    • https://cdn.shopify.com/s/files/1/0433/8086/7235/files/lafejememorazom.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000067bb.bin
b4e4b0d437c21233afec5e458aa42fadb7e2a0813e40bd969225f7dd32669d7b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x67BB 5316 bytes
font_01_sfnt_off000079c8.bin
2a3e62b2cc6f9ca21ff8a3df6e15f4cdaa2ea07c3bfd56c2ebbbccc7d6f28d2e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x79C8 10068 bytes
font_02_sfnt_off00009c2a.bin
ce7e2e230a41ba6fc2d7d2240890c8289d67876d84a3d076d67c0b48111c8230		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9C2A 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.