Malicious PDF — malware analysis report

Static analysis result for SHA-256 480c2a0361130c3e…

MALICIOUS

PDF

158.9 KB Created: 2020-09-18 02:59:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 00bfbdd9a6fc7b832259e57e444e8fc9 SHA-1: cecedd135769f0dcac49ad73625cbc134ad8c634 SHA-256: 480c2a0361130c3e8ca8c22d423ed3f9754ffb71073a9cede6426cb1d54d9f65
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.001 User Execution: Malicious Link T1059.001 PowerShell

The PDF file contains a critical heuristic firing indicating a malicious redirector link. The embedded URL, 'https://ttraff.ru/wb?keyword=honkai%20impact%203rd%20apk%20mod', is associated with malicious redirector infrastructure. The document body, though heavily obfuscated, contains text referencing 'Honkai impact 3rd apk mod', suggesting a lure to download potentially malicious software. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wb?keyword=honkai%20impact%203rd%20apk%20mod
    • http://vivozu.montevistachamber.org/uploads/1/3/0/7/130775823/cbd8f7f21.pdf
    • http://files.livfoodmarket.com/uploads/1/3/1/6/131606260/700dd.pdf
    • https://cdn.shopify.com/s/files/1/0428/3075/8054/files/76300708978.pdf
    • https://cdn.shopify.com/s/files/1/0429/3161/7945/files/nusedaji.pdf
    • https://cdn.shopify.com/s/files/1/0433/0065/1158/files/93106710922.pdf
    • https://cdn.shopify.com/s/files/1/0434/4227/4454/files/bosar.pdf
    • https://cdn.shopify.com/s/files/1/0437/3679/3237/files/batting_tips_in_cricket.pdf
    • https://cdn.shopify.com/s/files/1/0430/9116/5333/files/standard_organization_and_regulations_manual_sorm.pdf
    • https://cdn.shopify.com/s/files/1/0434/0108/5082/files/nefolujofetese.pdf
    • https://cdn.shopify.com/s/files/1/0431/1325/0972/files/39327763699.pdf
    • https://cdn.shopify.com/s/files/1/0435/0876/0735/files/1080p_sample_video_mkv.pdf
    • https://cdn.shopify.com/s/files/1/0428/7148/8668/files/47022280282.pdf
    • https://cdn.shopify.com/s/files/1/0481/7069/6855/files/gugorigikoralirele.pdf
    • https://cdn.shopify.com/s/files/1/0433/9105/8078/files/steps_of_problem_solving_method.pdf
    • https://cdn.shopify.com/s/files/1/0436/0785/1171/files/bridal_chorus_partition.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00020a61.bin
ceeb5736d4ab8b42b1e892460bf3b81a47979de46b32a2d89c38f4d21a248fb9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x20A61 5200 bytes
font_01_sfnt_off00021bee.bin
b522d4fb8a5e4119d6f948a0c04ce3778bf24986a15551381970211a44dfd7ce		 pdf-font-stream PDF embedded font (sfnt) at offset 0x21BEE 8024 bytes
font_02_sfnt_off000230fb.bin
3364fbd1314e6d01bc23ade33759581e6c41c37adb5fe754ecefe8ecf978cda5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x230FB 27616 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.