Malicious PDF — malware analysis report

Static analysis result for SHA-256 3b362213a1780e02…

MALICIOUS

PDF

48.1 KB Created: 2020-08-20 03:06:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 18e397e013452ad7ad3b39b288ad81ab SHA-1: 3ac8a13ce71709e0e81c5f5277f29f280477da55 SHA-256: 3b362213a1780e02b3a85c1b4a62359387a8e82ca5a465e46be5fa84e05a0d23
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.001 Malicious Link T1059.001 PowerShell

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'ttraff.com'. The document body, though heavily obfuscated, contains the same URL. This indicates the primary goal is to redirect the user to malicious content. The PDF also contains a large number of external links, many hosted on 'cdn.shopify.com', suggesting a link farm or SEO poisoning tactic to improve search engine ranking for the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=coursera+machine+learning+week+2+assignment+answers
    • http://pelomawad.equineagility.com/uploads/1/3/1/6/131607163/b00372e6b8.pdf
    • http://files.dawnscarzellamd.com/uploads/1/3/0/8/130874379/3761102.pdf
    • https://cdn.shopify.com/s/files/1/0429/2889/8211/files/3ds_ftp_server.pdf
    • https://cdn.shopify.com/s/files/1/0436/6457/2569/files/15102665230.pdf
    • https://cdn.shopify.com/s/files/1/0431/3756/4839/files/the_logical_song_sax_solo_sheet_music.pdf
    • https://cdn.shopify.com/s/files/1/0431/7229/8918/files/gedabuzevexujubido.pdf
    • https://cdn.shopify.com/s/files/1/0450/6674/8056/files/algebra_2_common_core_big_ideas_textbook.pdf
    • https://cdn.shopify.com/s/files/1/0432/4841/8973/files/60876446227.pdf
    • https://cdn.shopify.com/s/files/1/0428/9773/5843/files/freepbx_call_center_reporting.pdf
    • https://cdn.shopify.com/s/files/1/0430/4021/1097/files/22046627236.pdf
    • https://cdn.shopify.com/s/files/1/0440/1581/2766/files/gasping_for_airtime.pdf
    • https://cdn.shopify.com/s/files/1/0433/2011/5358/files/36075715795.pdf
    • https://cdn.shopify.com/s/files/1/0434/0934/2621/files/78482452653.pdf
    • https://cdn.shopify.com/s/files/1/0433/7837/6853/files/86461890254.pdf
    • https://cdn.shopify.com/s/files/1/0431/7757/4562/files/83257861734.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://cdn.shopify.com/s/fi

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000672c.bin
9dcedc5a57f17fa38fd3d2870fabbefb6ba30267ce715f7d70f5f6149bfe3fb1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x672C 5408 bytes
font_01_sfnt_off0000797e.bin
02828c2f98e46951b9db0acb6abf74905ca86604305c94e21d7337904d905ab5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x797E 10944 bytes
font_02_sfnt_off00009e88.bin
4471f92216f50ed59660dfde07325d7bc7936b356a877ae20405b399f7876638		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9E88 16060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.