Malicious PDF — malware analysis report

Static analysis result for SHA-256 50f908ee29f4f817…

MALICIOUS

PDF

41.5 KB Created: 2020-08-30 13:41:24 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bc471b77d9422ca2197b9a53f6893659 SHA-1: 257ca6e43c1391e606e28e52fd6fbd47c70a0e48 SHA-256: 50f908ee29f4f8173670aebc99ed4f37a4340944caeba869079f751a8e260160
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, with one heuristic specifically identifying it as a PDF link farm. One of these links, https://ttraff.cc/wix?keyword=metodologia+experimental+definicion, points to known malicious redirector infrastructure. The document body contains garbled text but includes the same URL, suggesting a lure to external content. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=metodologia+experimental+definicion
    • https://cdn.shopify.com/s/files/1/0431/7465/8197/files/67677409540.pdf
    • https://cdn.shopify.com/s/files/1/0431/6643/3429/files/90717414148.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/gowavofopinesifaremoka.pdf
    • https://cdn.shopify.com/s/files/1/0437/5350/4917/files/systematic_review_and_meta_analysis_book.pdf
    • https://cdn.shopify.com/s/files/1/0431/5286/7477/files/dd2_incursion_guide.pdf
    • https://static.usrfiles.com/ugd/b8c837_e13da048f9344248bcfe33ac53382547.pdf
    • https://static.usrfiles.com/ugd/ce0e6d_85afeb51a6b24fc196f60d26485b1d52.pdf
    • https://static.usrfiles.com/ugd/8de238_0602642362bf4770aa6379eb67116747.pdf
    • https://static.usrfiles.com/ugd/7198c1_7cde32ce56a1485bb12012d9d57d80cd.pdf
    • https://static.usrfiles.com/ugd/b8c837_7ee64cc5bdc248c58947aa9b94236728.pdf
    • https://cdn.shopify.com/s/files/1/0435/0096/1947/files/29412938368.pdf
    • https://cdn.shopify.com/s/files/1/0429/0707/4723/files/effects_of_alcohol_abuse.pdf
    • https://cdn.shopify.com/s/files/1/0429/6612/2662/files/formal_wrap_dress_with_sleeves.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000058ff.bin
8a47905b9b091673c3ae6f122d6f7f54f860d675f388646822bc79d6c09c84ee		 pdf-font-stream PDF embedded font (sfnt) at offset 0x58FF 5160 bytes
font_01_sfnt_off00006a7d.bin
dd0a6fce838b2f0eff5520d57a9a3ac5da6ca2ad87ee33b197be681fc215a2ba		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6A7D 9584 bytes
font_02_sfnt_off00008b31.bin
b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8B31 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.