Malicious PDF — malware analysis report

Static analysis result for SHA-256 3d4cde888829de82…

MALICIOUS

PDF

43.2 KB Created: 2020-08-18 14:32:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ad9695d8f98bdf31690d8cda80e9bb01 SHA-1: ef6bda8bf0a7664e77a685e3ada253f81a27f621 SHA-256: 3d4cde888829de82a46cdc007e0e9d2fc792199a1a90e3d535d14fa61a24b2dd
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.cc/pify?keyword=bleeding+love+free+piano+sheet+music'. This URL is presented within the document body, disguised as free piano sheet music, indicating a social engineering lure. The PDF also hosts a link farm, with many links pointing to Shopify, but one suspicious link to 'http://tovevib.odriscollcollective.com/uploads/1/3/1/3/131397970/mejuraseki.pdf'. The ML classifier strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=bleeding+love+free+piano+sheet+music
    • http://tovevib.odriscollcollective.com/uploads/1/3/1/3/131397970/mejuraseki.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/63545483179.pdf
    • https://cdn.shopify.com/s/files/1/0428/9419/6902/files/zisurojukixewa.pdf
    • https://cdn.shopify.com/s/files/1/0435/7583/6840/files/domafavofemojivisudorodup.pdf
    • https://cdn.shopify.com/s/files/1/0433/6071/4904/files/fawilobufud.pdf
    • https://cdn.shopify.com/s/files/1/0432/5205/6227/files/65910819043.pdf
    • https://cdn.shopify.com/s/files/1/0438/6396/5861/files/32982971199.pdf
    • https://cdn.shopify.com/s/files/1/0430/3529/5905/files/76612934910.pdf
    • https://cdn.shopify.com/s/files/1/0431/8353/8331/files/liwopawabisit.pdf
    • https://cdn.shopify.com/s/files/1/0433/7729/5516/files/first_time_abatement_letter_sample.pdf
    • https://cdn.shopify.com/s/files/1/0436/4386/3198/files/pilululekekax.pdf
    • https://cdn.shopify.com/s/files/1/0435/3320/5655/files/xavapodezivekutereju.pdf
    • https://cdn.shopify.com/s/files/1/0434/5852/7397/files/metal_forming_process_nptel.pdf
    • https://cdn.shopify.com/s/files/1/0433/3810/5000/files/pitokarizirin.pdf
    • https://cdn.shopify.com/s/files/1/0437/6435/1130/files/sefezagiwigokibip.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000059be.bin
b376ef22ff55eee679bd299dc07ea8fc60ce6637a77f7ba07aeb6430b1f12c79		 pdf-font-stream PDF embedded font (sfnt) at offset 0x59BE 5680 bytes
font_01_sfnt_off00006cea.bin
691cf348e35c4af32ef957a6a5018f1e37813486870de0f43638e15737e5bbb5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6CEA 15464 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.