Malicious PDF — malware analysis report

Static analysis result for SHA-256 448f23118bf6224c…

MALICIOUS

PDF

65.4 KB Created: 2020-07-31 11:00:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fc9cdd50ac963f0714ec82b4cb1b7cfa SHA-1: 3d96db7a845bb0add57da4d7df988e92d0872296 SHA-256: 448f23118bf6224cb25d23b075ee28dc8a77ab7c4d3e633732f8589b3264d8d1
152 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.002 Spearphishing Attachment

The PDF contains embedded links that point to a known malicious redirector, ttraff.com. The document body, though heavily obfuscated, suggests a lure related to an 'application form'. The presence of numerous external PDF links, many hosted on Shopify, indicates a link farm strategy to obscure the ultimate malicious destination. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=jnv+application+form+pdf
    • http://files.moldandwaterdamagespecialistinc.com/uploads/1/3/1/4/131408170/4551431.pdf
    • http://files.infinitely-natural.com/uploads/1/3/1/8/131871799/d81780cecd.pdf
    • http://files.itbfm.com/uploads/1/3/0/8/130814078/roxexone.pdf
    • http://files.exuberantoiler.com/uploads/1/3/1/4/131406578/vowunekeko.pdf
    • https://cdn.shopify
    • https://cdn.shopify.com/s/files/1/0433/3905/5253/files/rigefokogegemesag.pdf
    • https://cdn.shopify.com/s/files/1/0430/1117/8649/files/50094392879.pdf
    • https://cdn.shopify.com/s/files/1/0434/3093/6732/files/mogagukesemuvo.pdf
    • https://cdn.shopify.com/s/files/1/0428/0687/0183/files/vodavi.pdf
    • https://cdn.shopify.com/s/files/1/0431/3631/9639/files/41855322545.pdf
    • https://cdn.shopify.com/s/files/1/0428/7974/6201/files/90438381854.pdf
    • https://cdn.shopify.com/s/files/1/0432/9072/2469/files/9900750678.pdf
    • https://cdn.shopify.com/s/files/1/0433/9495/7470/files/mubemakuzuwojetibobokuw.pdf
    • https://cdn.shopify.com/s/files/1/0433/8830/5558/files/63727608068.pdf
    • https://cdn.shopify.com/s/files/1/0437/9246/6080/files/senulikogipuxomoda.pdf
    • https://cdn.shopify.com/s/files/1/0429/6055/2085/files/getudokelesixasebipibuve.pdf
    • https://cdn.shopify.com/s/files/1/0435/7062/6723/files/22120530054.pdf
    • https://cdn.shopify.com/s/files/1/0434/1579/7917/files/bafamusixuxibanefafi.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000a0d8.bin
31ec0f5fd79fdd4343170b0f83008207266727dff04e211cb50ab423384dfe4a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA0D8 4844 bytes
font_01_sfnt_off0000b12c.bin
4833a1f2d117498a60c3e44abe0fa20c387e801c690b6d0a957328c9ef15587b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB12C 6052 bytes
font_02_sfnt_off0000c4dc.bin
2c079ab15f3d87f0a67beed953e8e24639d7c85dd1cf40bed4e591b2b6e92d0a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC4DC 10752 bytes
font_03_sfnt_off0000e93a.bin
01c2b9be7cb691afc726ff6bbe757b34914b1f2bc2dcafd8f2f584f9206a4aa8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE93A 3744 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.