Malicious PDF — malware analysis report

Static analysis result for SHA-256 3d1b8a457aa40293…

MALICIOUS

PDF

45.1 KB Created: 2020-08-30 04:05:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: afe99552feee54458c00fa913cad2512 SHA-1: 5bc44e2ccfaaa24eafc3382c2abb1ff91dab57ce SHA-256: 3d1b8a457aa40293cbedcb2cecfe2335f57f05ebf0bfb0ffbe7b9fd58ee2ae46
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a link to a known malicious redirector, ttraff.ru, disguised with a search query about UML activity diagrams. This heuristic, combined with the ML classifier flagging the PDF as malicious, strongly suggests a phishing or redirection attack. The document body, though heavily obfuscated, also contains the malicious URL, reinforcing the attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=how+to+draw+activity+diagram+in+uml+with+example
    • https://cdn.shopify.com/s/files/1/0433/4131/6249/files/46422185271.pdf
    • https://cdn.shopify.com/s/files/1/0439/7219/8558/files/denupikixejoro.pdf
    • https://cdn.shopify.com/s/files/1/0431/1813/3405/files/natural_language_processing.pdf
    • https://static.usrfiles.com/ugd/3b0c81_d4e1679fc0af4eec8409dc003e116e3c.pdf
    • https://static.usrfiles.com/ugd/80c1db_e4be0be9aebd40b0ac730ff48f6d77b8.pdf
    • https://static.usrfiles.com/ugd/b8c837_a7a252441d884de2baec531a4f2ec1b5.pdf
    • https://static.usrfiles.com/ugd/b8c837_eeeec7059f2c46c69f5ad0e5a6696a2e.pdf
    • https://cdn.shopify.com/s/files/1/0436/6431/0425/files/78088281378.pdf
    • https://cdn.shopify.com/s/files/1/0431/3668/0102/files/90287082697.pdf
    • https://cdn.shopify.com/s/files/1/0437/9652/9314/files/3838467240.pdf
    • https://cdn.shopify.com/s/files/1/0459/8523/5111/files/voresisijufovule.pdf
    • https://cdn.shopify.com/s/files/1/0439/1275/7400/files/ronuvonewalami.pdf
    • https://cdn.shopify.com/s/files/1/0431/5788/0996/files/67177710644.pdf
    • https://cdn.shopify.com/s/files/1/0431/0633/6925/files/brobar_boli_song_video_status.pdf
    • https://cdn.shopify.com/s/files/1/0433/1329/9620/files/2596259715.pdf
    • https://cdn.shopify.com/s/files/1/0431/5627/5362/files/mapamundi_con_nombres_para_imprimir.pdf
    • https://cdn.shopify.com/s/files/1/0432/1987/8048/files/dofokubipi.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007039.bin
ec1cfa72cc1b1bcce9817e7ab501084a91e15fd20f7e42f74e065a98c06f06f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7039 5592 bytes
font_01_sfnt_off0000832f.bin
11d169449bed991248bf1cbefd9875843edf29ceffed95354c731542c7c23b26		 pdf-font-stream PDF embedded font (sfnt) at offset 0x832F 10496 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.