Malicious PDF — malware analysis report

Static analysis result for SHA-256 3bd32cf2210904e9…

MALICIOUS

PDF

42.5 KB Created: 2020-09-01 09:20:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a4c5cc09d3a818eb086f06f56dc9de38 SHA-1: bd39bc22afffad5535a87cf36a9e78394b833f49 SHA-256: 3bd32cf2210904e932871948c41880e761a5113f91ade493cbc2bdbc49280bac
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF file contains a lure for a 'Spotify apk indir android' and embeds numerous links. One of these links, 'https://ttraff.club/pify?keyword=spotify+apk+indir+android', is identified as a malicious redirector. The PDF structure and the presence of a link farm suggest an attempt to drive traffic to malicious sites, likely for further exploitation or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/pify?keyword=spotify+apk+indir+android
    • https://static.usrfiles.com/ugd/c0fca2_8b364f7eaab64da18d7e1c2da0eff93e.pdf
    • https://static.usrfiles.com/ugd/136d07_49e82de420964a539c5884e49b7fb896.pdf
    • https://static.usrfiles.com/ugd/078c79_2c3cbf7bdca04d6fa19d5569a5d3b442.pdf
    • https://static.usrfiles.com/ugd/2b3f46_3ed765f58cb949968e9ad722da5dca64.pdf
    • https://static.usrfiles.com/ugd/451a43_e2167d5ddb3949a28fcbc091c80bdb97.pdf
    • https://cdn.shopify.com/s/files/1/0440/8773/8533/files/nuzobomupexixaselozibos.pdf
    • https://cdn.shopify.com/s/files/1/0433/4672/2974/files/pamiribupami.pdf
    • https://cdn.shopify.com/s/files/1/0448/3104/7842/files/sibanixomanijalok.pdf
    • https://cdn.shopify.com/s/files/1/0435/8442/2051/files/farmacologia_antibioticos.pdf
    • https://static.usrfiles.com/ugd/0cd019_38b9ef935d8d4fc48faf7f134b0f57d2.pdf
    • https://static.usrfiles.com/ugd/a4e402_ed10018dc14049168c1a030d082d91bf.pdf
    • https://static.usrfiles.com/ugd/47b1e8_ca39b423918e4b6e9d2bc3cedec77fc1.pdf
    • https://static.usrfiles.com/ugd/daca0d_b50aca014eb2499abfdc6d3ab5e23aef.pdf
    • https://static.usrfiles.com/ugd/07e02c_cf633248aa794bf7a1231bf58a00f1c1.pdf
    • https://static.usrfiles.com/ugd/b8c837_16a197206b3d42e798e881b61fe74dd9.pdf
    • https://static.usrfiles.com/ugd/ac51ce_48ed1cbb86d34c66a72ef18ac7272b51.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006814.bin
e66968372ae0c32550c8e9fe21a8138566737cdf18e4eb9799d747d9f40d9b63		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6814 5092 bytes
font_01_sfnt_off00007987.bin
8398107b6ca64a51604294a4f72db00266d4f891ea79be4499e74e473e19bde5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7987 10528 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.