Malicious PDF — malware analysis report

Static analysis result for SHA-256 48f01ad580c8f484…

MALICIOUS

PDF

126.8 KB Created: 2020-08-07 14:33:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2d61c33bb7e9c8007ff48f4c4579b1ee SHA-1: 00d020ef0ced3cf0f01f33456749a977d02ceec6 SHA-256: 48f01ad580c8f484a2ca0edb240078cfea8e639d3041aa82be00ea608d0e7069
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'ttraff.com'. Additionally, it exhibits characteristics of a PDF link farm, with numerous embedded URLs, many hosted on 'cdn.shopify.com'. The ML classifier also strongly flagged this PDF as malicious. The primary attack vector appears to be social engineering, directing users to a malicious site under the guise of providing an educational PDF.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=saddleback+educational+publishing+basic+english+grammar+book+3+pdf
    • http://mofino.hilaryhachey.com/uploads/1/3/0/7/130775432/pijexomutola-pabif-zopujujerol.pdf
    • http://files.fearnotministries.com/uploads/1/3/0/7/130776402/618120.pdf
    • http://files.bluebarnbbq.com/uploads/1/3/0/7/130776493/tasituxajewusid-rotirotutuziro-zibogaviwunaxo-nataluvifu.pdf
    • http://files.toadsandtulips.com/uploads/1/3/2/6/132681665/3689397.pdf
    • https://cdn.shopify.com/s/files/1/0431/5024/6054/files/dawobijebenu.pdf
    • https://cdn.shopify.com/s/files/1/0429/7519/9391/files/72581589169.pdf
    • https://cdn.shopify.com/s/files/1/0430/8857/6661/files/fudubesevegowi.pdf
    • https://cdn.shopify.com/s/files/1/0439/8107/8686/files/napulixubew.pdf
    • https://cdn.shopify.com/s/files/1/0432/3196/9438/files/35180361182.pdf
    • https://cdn.shopify.com/s/files/1/0448/0807/7473/files/grade_6_math_worksheets_cbse.pdf
    • https://cdn.shopify.com/s/files/1/0427/7341/4055/files/gitewupibovotabinuxe.pdf
    • https://cdn.shopify.com/s/files/1/0434/7399/3890/files/57355390043.pdf
    • https://cdn.shopify.com/s/files/1/0431/2766/8890/files/nuxidufosezasubev.pdf
    • https://cdn.shopify.com/s/files/1/0434/1746/9086/files/nibajanefi.pdf
    • https://cdn.shopify.com/s/files/1/0427/5834/0774/files/see_you_again_lyrics_no_rap.pdf
    • https://cdn.shopify.com/s/files/1/0430/2562/9335/files/83909935423.pdf
    • https://cdn.shopify.com/s/files/1/0432/8708/5222/files/canoscan_lide_200_manual.pdf
    • https://cdn.shopify.com/s/files/1/0435/6092/7393/files/dudolubogofitubisebij.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001934c.bin
05a69fff7174e39a768e9110bd100b5e21d3820e6067700bc0a95aeeb0663d32		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1934C 6040 bytes
font_01_sfnt_off0001a7af.bin
39cac0dc4b889afed07b9fc9d233e42bc437813794f500592483fddd302449e0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1A7AF 14128 bytes
font_02_sfnt_off0001d51d.bin
e9c8e1667e33670d396922722dc64306abb72e0e699c2cf8df8097f97c71d066		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1D51D 16656 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.