Malicious PDF — malware analysis report

Static analysis result for SHA-256 41b91fcba42cf434…

MALICIOUS

PDF

59.3 KB Created: 2020-08-18 14:53:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e6af92c363e306cdbb35452149b8622e SHA-1: 48de0241b8983e387d9401c06a6c7aa135acda1a SHA-256: 41b91fcba42cf4344b7d94a5c8b182da6f7fde3b4f7a66fa83ec562c77cc85ea
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a critical heuristic firing for a malicious redirector link pointing to 'ttraff.com'. This link is presented with a keyword suggesting a lure for downloading an Android application. The document body, though heavily obfuscated, also contains the same URL and keywords, reinforcing the phishing or malicious download lure. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=airtel+tv+mod+apk+xda
    • http://files.minotadultlearningcenter.com/uploads/1/3/1/1/131163976/xosagovufelub_vamepogajuv_meniwejexo_jomawisesisixu.pdf
    • http://files.evergalvez.com/uploads/1/3/0/8/130814586/virareni_povewi_rakimo.pdf
    • https://cdn.shopify.com/s/files/1/0432/0627/9323/files/hex_cable_gland_catalogue.pdf
    • https://cdn.shopify.com/s/files/1/0434/7658/2552/files/16197950999.pdf
    • https://cdn.shopify.com/s/files/1/0430/4932/0610/files/shopsmith_jointer_manual.pdf
    • https://cdn.shopify.com/s/files/1/0431/7341/3028/files/13205251429.pdf
    • https://cdn.shopify.com/s/files/1/0431/7990/1085/files/baketilitegalexuxomuvemi.pdf
    • https://cdn.shopify.com/s/files/1/0433/1080/9256/files/nujigevutolinad.pdf
    • https://cdn.shopify.com/s/files/1/0433/5557/0341/files/30744299155.pdf
    • https://cdn.shopify.com/s/files/1/0437/9105/7058/files/wordly_wise_3000_book_7_lesson_4_answer_key.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/fuwakuda.pdf
    • https://cdn.shopify.com/s/files/1/0431/3025/7568/files/13740763890.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007f3c.bin
f9a4d2efa2c5dceebc0bb1c0033dda62f953364ed5eb04f94f972182dc8bae1f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7F3C 4792 bytes
font_01_sfnt_off00008f81.bin
97590726ca7cb161c5b7efec271f0521acab505f39e6a1184c4ff4de703ee0d6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8F81 2416 bytes
font_02_sfnt_off00009a1e.bin
2bb4e26fa2ae4342d600f548b835bb4db828c3516333dc47f93025e1a2390446		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9A1E 10308 bytes
font_03_sfnt_off0000bd93.bin
354dce64f07f3d7acdf6a04edf763950ffbfec4edcbb4bfe17b65a83544077bb		 pdf-font-stream PDF embedded font (sfnt) at offset 0xBD93 16036 bytes
font_04_sfnt_off0000d1fb.bin
d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD1FB 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.