Malicious PDF — malware analysis report

Static analysis result for SHA-256 3cf277219c8dfa13…

MALICIOUS

PDF

41.9 KB Created: 2020-09-04 16:57:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 04169fa225e7b20f7fe3738ac5e1ad7c SHA-1: 3ca1b69e94b62cd8262ffb45ddb8478b029a9309 SHA-256: 3cf277219c8dfa131072b2a688f3729e21f47b6de37b82d54f2206eb5cf9544a
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains numerous links, including one pointing to a known malicious redirector at 'https://ttraff.me/pify?keyword=real+love+test+calculator+app'. The document body, though heavily obfuscated, appears to be a lure for a 'real love test calculator app', aiming to trick users into clicking the malicious link. The presence of many external PDF links suggests a link farm or SEO poisoning tactic to distribute the malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/pify?keyword=real+love+test+calculator+app
    • https://cdn.shopify.com/s/files/1/0437/2099/9064/files/herbicida_ecologico_segador.pdf
    • https://cdn.shopify.com/s/files/1/0459/6229/7504/files/29234891249.pdf
    • https://cdn.shopify.com/s/files/1/0428/6221/5324/files/94514673105.pdf
    • https://cdn.shopify.com/s/files/1/0434/9070/5574/files/donuxifoviluxevisagisasa.pdf
    • https://cdn.shopify.com/s/files/1/0433/9276/2006/files/hernia_umbilical_infantil.pdf
    • https://static.usrfiles.com/ugd/1b8612_05009da7737b48fd8107883927c988ab.pdf
    • https://static.usrfiles.com/ugd/5f5755_833f55f3694b40d3830daa03b31d7fa4.pdf
    • https://static.usrfiles.com/ugd/b8c837_54acd1b4359e40bab030e4b644c34145.pdf
    • https://static.usrfiles.com/ugd/12f4eb_c9923318029b468fabe7168ca5a0e936.pdf
    • https://cdn.shopify.com/s/files/1/0457/6680/3622/files/ffxiv_heaven_on_high_weapon_guide.pdf
    • https://cdn.shopify.com/s/files/1/0433/1234/9334/files/pseudomonas_uti_treatment_guidelines.pdf
    • https://static.usrfiles.com/ugd/6f9b04_f91f21ec672e4f18901801a789961b2e.pdf
    • https://static.usrfiles.com/ugd/f84671_e4b547facb9f4e74a4886819fa903dd9.pdf
    • https://static.usrfiles.com/ugd/4dd980_3c5e84dbdc334651b211d5bdf9631a1a.pdf
    • https://static.usrfiles.com/ugd/405339_03073a2e54b74f2996f2ad1bc495c14b.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006702.bin
3108f17888b1980a5eecf9b6317b53b68e26a555644c9804f9ff0b7736fe2e8f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6702 4992 bytes
font_01_sfnt_off0000781b.bin
2b36decdca3f26fa16d6bb942ec816681246d78ce1ebe9a5fb9ce4b298ac3aad		 pdf-font-stream PDF embedded font (sfnt) at offset 0x781B 10136 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.