Malicious PDF — malware analysis report

Static analysis result for SHA-256 4a665805d755d30d…

MALICIOUS

PDF

52.8 KB Created: 2020-08-04 03:53:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c07d970e33e2cc5d13ae090daaa18980 SHA-1: 81611bab02cf24d23afd6ebeab34d5a881d57685 SHA-256: 4a665805d755d30d324dc5e407c221646cbd8034c07688d10a2c93c9f792ea55
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links, many pointing to Shopify domains, but one critical link redirects to `ttraff.com`. This domain is flagged as a malicious redirector, indicating the document's primary purpose is to lead users to malicious content. The document body itself contains the text 'Phonetic symbols chart with examples pdf' and the malicious URL, reinforcing the lure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=phonetic+symbols+chart+with+examples+pdf
    • http://files.kocanada-usa.com/uploads/1/3/0/7/130776001/e53e3f22.pdf
    • http://files.moenkopimemories.org/uploads/1/3/1/4/131408537/3506090.pdf
    • http://files.resiliencestudiesconsortium.com/uploads/1/3/0/7/130776682/tazaluf-daduzirugib-zovepoxetugalop.pdf
    • https://cdn.shopify.com/s/files/1/0432/4173/4311/files/38909651678.pdf
    • https://cdn.shopify.com/s/files/1/0427/5778/3718/files/fegep.pdf
    • https://cdn.shopify.com/s/files/1/0429/9417/2058/files/rirosoxesom.pdf
    • https://cdn.shopify.com/s/files/1/0430/6019/9573/files/kci_wound_vac.pdf
    • https://cdn.shopify.com/s/files/1/0434/2982/2631/files/transporter_3_torren.pdf
    • https://cdn.shopify.com/s/files/1/0436/3078/8758/files/61385583478.pdf
    • https://cdn.shopify.com/s/files/1/0432/0106/9220/files/43011244409.pdf
    • https://cdn.shopify.com/s/files/1/0431/5319/5162/files/jiridevig.pdf
    • https://cdn.shopify.com/s/files/1/0430/6924/3553/files/86105184650.pdf
    • https://cdn.shopify.com/s/files/1/0430/4994/3202/files/88400724448.pdf
    • https://cdn.shopify.com/s/files/1/0427/6633/6166/files/88161181285.pdf
    • https://cdn.shopify.com/s/files/1/0430/4830/4797/files/fejopemolokufofabalejupo.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007a37.bin
641464f5fac8c2744592157c1e1e7812f6010da4a3b446553c47574417a1b444		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7A37 5800 bytes
font_01_sfnt_off00008de1.bin
9ce07057ce09b54952510e0ebc5fab80c20cc3067f3b35c468b635d4d1353a1f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8DE1 17552 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.