Malicious PDF — malware analysis report

Static analysis result for SHA-256 4f282fdde978046d…

MALICIOUS

PDF

33.1 KB Created: 2020-08-30 00:02:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e78eec72e75887fd8aa5c9acb48ecf09 SHA-1: 5c21e0ba9e60124831ba2ec401a32fd1f3214be9 SHA-256: 4f282fdde978046db3b6365b3047207b0b79208ee8f0257c08e9848f8eee388d
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.cc/wix?keyword=the+suite+life+on+deck+full+episodes+free'. Additionally, it exhibits a PDF link farm behavior, embedding numerous links, with the first identified as 'https://cdn.shopify.com/s/files/1/0434/7556/6752/files/palutowamogiwakeretemefez.pdf'. The ML classifier also strongly flagged this PDF as malicious. The document body, though heavily obfuscated, contains the same malicious URL and a list of other URLs, suggesting a social engineering lure to drive traffic to malicious infrastructure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=the+suite+life+on+deck+full+episodes+free
    • https://cdn.shopify.com/s/files/1/0434/7556/6752/files/palutowamogiwakeretemefez.pdf
    • https://cdn.shopify.com/s/files/1/0433/3669/5959/files/50300183168.pdf
    • https://cdn.shopify.com/s/files/1/0431/6577/8076/files/seti_ui_sublime.pdf
    • https://cdn.shopify.com/s/files/1/0432/1355/3827/files/albert_ellis_free_download.pdf
    • https://cdn.shopify.com/s/files/1/0428/6890/0006/files/kevovazawobavonol.pdf
    • https://cdn.shopify.com/s/files/1/0428/6945/7063/files/pool_party_flyer_free_template.pdf
    • https://cdn.shopify.com/s/files/1/0428/5346/6271/files/78910425636.pdf
    • https://cdn.shopify.com/s/files/1/0437/5104/7329/files/putawumuxewinemike.pdf
    • https://cdn.shopify.com/s/files/1/0429/9633/4753/files/briggs_and_stratton_engine_manuals.pdf
    • https://cdn.shopify.com/s/files/1/0432/1070/3010/files/vikapag.pdf
    • https://cdn.shopify.com/s/files/1/0440/4668/0214/files/act_parser_ffxiv.pdf
    • https://cdn.shopify.com/s/files/1/0429/4829/6857/files/76370169369.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/3215656586.pdf
    • https://cdn.shopify.com/s/files/1/0431/0489/5143/files/nimulafukiguli.pdf
    • https://cdn.shopify.com/s/files/1/0462/0075/0243/files/latest_android_oreo_phones.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000432a.bin
63506616c29d55459d0a73bb9c2125ba3f28d21972191a193c098ae54845fea3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x432A 5044 bytes
font_01_sfnt_off0000544a.bin
560fdda3700186c1c4a78b2bbaabd60c1f65311c0ab88e24d6bdb153d22cfec7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x544A 9544 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.