Malicious PDF — malware analysis report

Static analysis result for SHA-256 50f41105a872465c…

MALICIOUS

PDF

36.5 KB Created: 2020-08-30 22:43:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b0d600c3bdd272db53c99d733ee447ce SHA-1: f48a0d2bb5a1063caabbf798e9f5c412a7c349f0 SHA-256: 50f41105a872465cb829cf9f0831f7889f9e00f0607ceff49b062af477b9d933
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a link to a known malicious redirector, ttraff.com, which is disguised with text related to forensic protocols. This suggests a phishing or social engineering attack aimed at directing users to malicious content. The ML classifier also strongly indicated maliciousness. No scripts were extracted, but the presence of a malicious redirector is a high-confidence indicator of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=protocolo+para+el+tratamiento+e+identificaci%25C3%25B3n+forense+pdf
    • https://cdn.shopify.com/s/files/1/0463/9850/5115/files/electric_circuit_breaker_panel_directory_sheet.pdf
    • https://cdn.shopify.com/s/files/1/0432/8062/9913/files/9937787638.pdf
    • https://cdn.shopify.com/s/files/1/0462/2024/7194/files/99257593262.pdf
    • https://cdn.shopify.com/s/files/1/0437/5412/7521/files/path_of_war.pdf
    • https://cdn.shopify.com/s/files/1/0437/5658/5114/files/12098795853.pdf
    • https://static.usrfiles.com/ugd/69695d_73d6e4ee6e8843cb954afb19a6a059c1.pdf
    • https://cdn.shopify.com/s/files/1/0433/7962/2040/files/xerufodakebagukow.pdf
    • https://cdn.shopify.com/s/files/1/0430/8451/3434/files/kawasaki_repair_manual_free_download.pdf
    • https://cdn.shopify.com/s/files/1/0434/4496/1436/files/57061210230.pdf
    • https://cdn.shopify.com/s/files/1/0432/4232/4125/files/quality_assurance_documentation.pdf
    • https://cdn.shopify.com/s/files/1/0427/4244/8295/files/96197022174.pdf
    • https://cdn.shopify.com/s/files/1/0432/5448/1054/files/ximep.pdf
    • https://cdn.shopify.com/s/files/1/0431/3258/4087/files/22254368293.pdf
    • https://cdn.shopify.com/s/files/1/0427/6797/4556/files/60470641801.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004367.bin
680d82115b43da54f096997a36179a79db1cbb1f1a4c8578f42aed29494f6e76		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4367 5228 bytes
font_01_sfnt_off000054cc.bin
b81a232388f9ddba1637fe536a857e135f80988f47215a44057a836c16711bf3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x54CC 9568 bytes
font_02_sfnt_off0000740d.bin
ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x740D 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.