Malicious PDF — malware analysis report

Static analysis result for SHA-256 443eeb9f16c86d5b…

MALICIOUS

PDF

43.7 KB Created: 2020-08-18 15:29:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fbe7eae9c92765fed450b536c3f9f474 SHA-1: bb34c21a7b4e02a4d881dab4ca588925a5475810 SHA-256: 443eeb9f16c86d5b7a755a9bec3ee56621ef54c9a2091c2ec2b5110de9daca3a
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links, many pointing to Shopify domains and a suspicious redirector at 'ttraff.cc'. The ML classifier strongly indicated maliciousness. The primary attack pattern involves luring the user to click on these links, which likely lead to malicious content or further compromise. No scripts were extracted, but the PDF structure itself is the delivery mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=canvas+to+image
    • http://files.lewisburglighthouse.com/uploads/1/3/1/8/131871864/fovonitoz_zufisarodit.pdf
    • http://files.john3ministries.org/uploads/1/3/0/7/130775171/5969093.pdf
    • http://files.coloradoaps.com/uploads/1/3/0/9/130969089/cfa70280.pdf
    • http://files.gottadancesimivalley.com/uploads/1/3/1/3/131384211/eda1ec81.pdf
    • https://cdn.shopify.com/s/files/1/0433/3817/0523/files/zetuw.pdf
    • https://cdn.shopify.com/s/files/1/0431/7275/7668/files/fupodakovuturunowoguzagu.pdf
    • https://cdn.shopify.com/s/files/1/0448/9232/3995/files/xefokujonigetu.pdf
    • https://cdn.shopify.com/s/files/1/0432/8233/3856/files/zadizevasoroz.pdf
    • https://cdn.shopify.com/s/files/1/0432/5317/0334/files/whirlpool_ultimate_care_ii.pdf
    • https://cdn.shopify.com/s/files/1/0432/4697/7179/files/69799543221.pdf
    • https://cdn.shopify.com/s/files/1/0448/1577/7954/files/chinese_calligraphy_exercises.pdf
    • https://cdn.shopify.com/s/files/1/0432/6942/3269/files/safuwodokefeze.pdf
    • https://cdn.shopify.com/s/files/1/0429/4233/3084/files/calendar_app_ios_android_windows.pdf
    • https://cdn.shopify.com/s/files/1/0435/2504/6431/files/viii_roman_numerals.pdf
    • https://cdn.shopify.com/s/files/1/0433/7431/3621/files/gapedunixikiximobem.pdf
    • https://cdn.shopify.com/s/files/1/0429/8424/3351/files/89244314186.pdf
    • https://cdn.shopify.com/s/files/1/0435/6092/7393/files/iti_admission_form_download.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000608a.bin
ef05bf959160fa1184cc7c0c1f076e6a6aaa0c4314f4b1392e98cb74716ad861		 pdf-font-stream PDF embedded font (sfnt) at offset 0x608A 4844 bytes
font_01_sfnt_off000070f5.bin
6d2a3a16cc464ce72cf05976c7f96a31c93af2202e0dc760c37a694345e222ee		 pdf-font-stream PDF embedded font (sfnt) at offset 0x70F5 1800 bytes
font_02_sfnt_off00007985.bin
4d9bcb0381a598ba9eea98eac046a189bf0771572581a41301187fb3d51cd37f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7985 11980 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.