Malicious PDF — malware analysis report

Static analysis result for SHA-256 51fa34e10e538eb1…

MALICIOUS

PDF

68.8 KB Created: 2020-08-05 10:58:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bfea6d222e73c2c047db1b20afeda7ab SHA-1: fdd8c27b77fe71477a401b2a9dfd01ed86fce586 SHA-256: 51fa34e10e538eb130c1069b06da949b8adc7670de84e7009fdd40b525053186
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains multiple embedded URLs, with a critical heuristic firing indicating a malicious redirector link to 'ttraff.ru'. Another critical heuristic identified a large number of external PDF links, suggesting a link farm. The ML classifier also strongly flagged this PDF as malicious. The embedded document body text, though heavily corrupted, contains the same URL found in the malicious redirector heuristic, reinforcing the malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wb?keyword=correlation-based%20feature%20selection%20for%20machine%20learning%20pdf
    • http://files.buyalphabetphotos.com/uploads/1/3/1/3/131379117/zidovoxa.pdf
    • http://files.butternutconsultants.com/uploads/1/3/1/4/131452959/c669a24732cdc.pdf
    • http://files.fredhansenre.com/uploads/1/3/1/3/131398367/gigaroruriba_vuduw_sotev_bujefovu.pdf
    • https://cdn.shopify.com/s/files/1/0438/8870/5688/files/roxedetapovoburum.pdf
    • https://cdn.shopify.com/s/files/1/0436/6965/1606/files/kotikavekesakopoba.pdf
    • https://cdn.shopify.com/s/files/1/0428/1306/3327/files/55430066564.pdf
    • https://cdn.shopify.com/s/files/1/0435/3484/4059/files/wumubedajan.pdf
    • https://cdn.shopify.com/s/files/1/0437/6523/5866/files/4097492438.pdf
    • https://cdn.shopify.com/s/files/1/0430/2631/7473/files/xorotagikowopevelemuz.pdf
    • https://cdn.shopify.com/s/files/1/0436/1561/7182/files/copaiba_softgels_doterra.pdf
    • https://cdn.shopify.com/s/files/1/0429/8535/7463/files/26002373849.pdf
    • https://cdn.shopify.com/s/files/1/0432/7673/0533/files/85314288298.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://cdn.shopify.com/s/files/1/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b02a.bin
4609a5380bb81b4589cda0c79b40a58b100b8342f49c8aa1ee242242cf1beb89		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB02A 5648 bytes
font_01_sfnt_off0000c331.bin
f164e32cc850d71bfa75f6753a31b193b35fcc39c10a6a070c34fca2c2045267		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC331 14564 bytes
font_02_sfnt_off0000f092.bin
e9f71365a2a9ea4b152c2f6701d7ccf33f67bf216d443f7f7b47b7c3311bc682		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF092 16112 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.