Malicious PDF — malware analysis report

Static analysis result for SHA-256 4022538988b33340…

MALICIOUS

PDF

38.2 KB Created: 2020-09-19 20:10:19 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 02f2808975ab868823be9ee67311d789 SHA-1: 24e60b9943298f0dae2487526fb321f3cc7f1b1e SHA-256: 4022538988b33340ab7792671e46a9518303601e9d082c25bb2106e56a0fc71a
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by multiple critical heuristics for containing malicious redirector links and a link farm. The embedded document body text, though heavily obfuscated, contains the URL https://ttraff.club/wix?keyword=salt+and+sanctuary+lock+of+hair, which is identified as a malicious redirector. The presence of numerous other links, many pointing to Shopify domains, suggests a coordinated effort to distribute malicious content or conduct phishing attacks.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/wix?keyword=salt+and+sanctuary+lock+of+hair
    • https://6b3634b7-e8f1-4368-a67e-949
    • https://cdn.shopify.com/s/files/1/0433/9616/9886/files/mandated_reporting_online_pa.pdf
    • https://cdn.shopify.com/s/files/1/0428/7430/6727/files/2420466158.pdf
    • https://cdn.shopify.com/s/files/1/0429/5540/7511/files/fazusodokodubusi.pdf
    • https://cdn.shopify.com/s/files/1/0465/1198/0694/files/82818421922.pdf
    • https://9ddbeb56-2daa-46aa-af17-ce366d8e9f60.filesusr.com/ugd/38062a_0c1f9b7d963944d58eccd15abfd15b3d.pdf?index=true
    • https://d746335e-0747-4e8f-a4cc-688eeae0996c.filesusr.com/ugd/704566_16dce61eb1f1472ea30213f54c81f510.pdf?index=true
    • https://e544feea-9643-42aa-b244-67630e73694b.filesusr.com/ugd/22739b_51f400fac2384df3b939c789f81fa609.pdf?index=true
    • https://2fc8e2f1-416d-4875-b328-ef206fa1fca6.filesusr.com/ugd/9734e7_fc806177d521438d90b489d784fd08c8.pdf?index=true
    • https://cac8da76-4484-4612-88c5-822f57100764.filesusr.com/ugd/4a2613_572f5e43f17d416faaa5246264011804.pdf?index=true
    • https://017cb928-5995-4f01-8537-291f24fb30f6.filesusr.com/ugd/d55797_af04984591d4468885e43cc40a3633a9.pdf?index=true
    • https://61c8c4a6-809d-4108-a29f-d4927a7d9bc8.filesusr.com/ugd/d8e941_825bc22268f8457c97f5d68bbe9db8f7.pdf?index=true
    • https://5049727e-87e9-4f75-821f-d34a0b3c108c.filesusr.com/ugd/2ac701_6985e1a9ca634f519544870990d377ce.pdf?index=true
    • https://09c68665-aea1-48b7-b053-415ce804c13c.filesusr.com/ugd/9ff9b8_74492b44cfd049c5b1beea831b143a04.pdf?index=true
    • https://6f377279-e9e1-4dea-85b9-0e469b6282f7.filesusr.com/ugd/f515ca_9a52109c783941fc9ad43ba7d287956c.pdf?index=true
    • https://9270e895-1301-4ff6-aea1-f79a8e0aa120.filesusr.com/ugd/91e123_55149ae276a840b9827dafd050bd33bd.pdf?index=true
    • https://df15b139-e3a4-43e6-bd83-d18dd8819e47.filesusr.com/ugd/7dd30d_c098cd18e9814b738d3a34868b5c65eb.pdf?index=true
    • https://6b3634b7-e8f1-4368-a67e-949197ec63ce.filesusr.com/ugd/39a0fd_6aa198e2118a4115be77b1d9e2721f09.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000561b.bin
3f53d330b75143561785f6d6df64ebadd191c4bd13bd45395258c74b79de8c75		 pdf-font-stream PDF embedded font (sfnt) at offset 0x561B 5380 bytes
font_01_sfnt_off00006869.bin
502a8fb32b25173a04d3efad97ef4a21682887e7e1b8c32476c3337c339ed9ac		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6869 10336 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.