Malicious PDF — malware analysis report

Static analysis result for SHA-256 430bee8cb58683f2…

MALICIOUS

PDF

39.8 KB Created: 2020-09-17 08:46:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 010ea4a9ee09de4b62f5bc21a69d8d46 SHA-1: 628933bf055c8ad2e0f4b11c8bab47330b0f392a SHA-256: 430bee8cb58683f2407a37ce5ea2245800224f1f355408b258e1dd1808835e7c
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links, many of which point to external PDF files hosted on various domains. One prominent link, 'https://ttraff.com/wb?keyword=cpo%20khaki%20uniform%20history', is identified as a malicious redirector. The document body, though heavily obfuscated, also contains this URL and other PDF links, suggesting a link farm or redirection tactic to lead users to malicious content. The ML classifier strongly supports the malicious nature of this PDF.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wb?keyword=cpo%20khaki%20uniform%20history
    • http://files.chantal-pollier.com/uploads/1/3/1/4/131482916/pewulefimope.pdf
    • http://pojojeper.nottsu3anetwork.org/uploads/1/3/0/7/130776407/solubazo_josuvajifupeda.pdf
    • http://files.coolrydescustoms.com/uploads/1/3/1/4/131483281/gigopujaxixe.pdf
    • http://files.jessica-elainephotography.com/uploads/1/3/0/7/130776791/kenopefutijive.pdf
    • http://files.tangerinetales.com/uploads/1/3/2/7/132741110/2734373.pdf
    • http://files.forcees.com/uploads/1/3/0/7/130740375/1358450.pdf
    • http://nirisusop.boneroomamberroom.com/uploads/1/3/1/3/131378816/8606185.pdf
    • http://wakopugax.verminatorstudios.net/uploads/1/3/2/6/132680852/budowijokeputima.pdf
    • http://ganiruz.kellypiliouras.com/uploads/1/3/0/7/130776031/efbe94f6bf2.pdf
    • https://cdn.shopify.com/s/files/1/0437/6104/1569/files/57831886017.pdf
    • https://cdn.shopify.com/s/files/1/0428/4104/7206/files/an_eggs_guide_to_minecraft_part_16.pdf
    • https://cdn.shopify.com/s/files/1/0429/9295/9642/files/aftermath_2017_movie_free.pdf
    • https://cdn.shopify.com/s/files/1/0440/4848/2454/files/dizimematutavugexidavegef.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/41448402009.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006016.bin
0515acfce11324522904cac0eb448e69240f84a7820e8c252d3364de19d8e6c7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6016 5180 bytes
font_01_sfnt_off00007194.bin
92a42dadfa36c5a9c6b15862db4695dccaa817c76510369feef25db555526808		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7194 9652 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.