Malicious PDF — malware analysis report

Static analysis result for SHA-256 431d5ca402f454dd…

MALICIOUS

PDF

55.7 KB Created: 2020-08-31 20:28:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bdace9d8e670e61a54deb297c41e255d SHA-1: aca11502f4b8b728365ab32ed45b6e5b93016b68 SHA-256: 431d5ca402f454ddd061b5dd565745e54770f348a96b651fdc02774d5013ece4
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'ttraff.com'. Additionally, it exhibits characteristics of a PDF link farm, with numerous links to Shopify domains, likely for SEO manipulation to increase visibility. The ML classifier strongly indicates maliciousness. No scripts were extracted, but the presence of a malicious redirector suggests a phishing or scam attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=apprendre+le+portugais+gratuitement+pdf
    • https://cdn.shopify.com/s/files/1/0435/5738/8440/files/rijejazotoruvutiveso.pdf
    • https://cdn.shopify.com/s/files/1/0432/1941/9291/files/the_brothers_grimm_spectaculathon.pdf
    • https://cdn.shopify.com/s/files/1/0457/7728/9372/files/94105971585.pdf
    • https://cdn.shopify.com/s/files/1/0434/3041/2450/files/rekebowotalabarumebokon.pdf
    • https://cdn.shopify.com/s/files/1/0429/6438/5951/files/rubenubaki.pdf
    • https://cdn.shopify.com/s/files/1/0438/1189/7504/files/69899859619.pdf
    • https://cdn.shopify.com/s/files/1/0431/7193/8461/files/danuxodavuxidefo.pdf
    • https://cdn.shopify.com/s/files/1/0432/0965/4432/files/wodufezesujuxevatedabufu.pdf
    • https://cdn.shopify.com/s/files/1/0428/7807/5036/files/vewir.pdf
    • https://cdn.shopify.com/s/files/1/0465/3803/1254/files/disable_button_reactive_form_angular_6.pdf
    • https://cdn.shopify.com/s/files/1/0438/6249/1286/files/atresia_esofagica_tipos.pdf
    • https://cdn.shopify.com/s/files/1/0430/8267/8433/files/25733862181.pdf
    • https://cdn.shopify.com/s/files/1/0431/3242/0262/files/vyprvpn_free_for_windows_xp.pdf
    • https://cdn.shopify.com/s/files/1/0438/9886/3771/files/57279590610.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007978.bin
d46e72ca3e72253d75a19bacd40418bc9ec32ba86950f9236f70bb140692d8c3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7978 5348 bytes
font_01_sfnt_off00008b8a.bin
a36eee06fef6ce219692c4ec918276ac99413e4fd1e3666e4031624f9289d620		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8B8A 1800 bytes
font_02_sfnt_off00009417.bin
c4c2f4741fcfdd44a2316136b791c3e9463a11458714f455a661fceff354b3e3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9417 11864 bytes
font_03_sfnt_off0000b988.bin
028dbaa76d48ae99b02248bacea50134e27ed131f5dd39e25ac401de8961e19b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB988 16312 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.