Malicious PDF — malware analysis report

Static analysis result for SHA-256 566ba58ab031e340…

MALICIOUS

PDF

45.0 KB Created: 2020-08-10 14:58:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a3de80d1ec85abf245710e51c05c89af SHA-1: 00831ce81df0c5c1cce00e115fba3dfef7e169fe SHA-256: 566ba58ab031e340ee1a37b8870e4b56b429a3190947dd48af2ed10a65fd9140
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.ru/pify?keyword=czasy+przysz%25C5%2582e+angielski+%25C4%2587wiczenia+pdf'. Additionally, it exhibits characteristics of a PDF link farm, with numerous external links, many hosted on cdn.shopify.com. The ML classifier also strongly flagged this PDF as malicious. The document body, though heavily corrupted, contains the malicious URL and several other Shopify URLs, suggesting a lure to download further content or be redirected to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=czasy+przysz%25C5%2582e+angielski+%25C4%2587wiczenia+pdf
    • http://files.kimblevins.com/uploads/1/3/1/3/131398335/gamaxoweliluvem-zokoxexada.pdf
    • http://files.kayohustle.com/uploads/1/3/0/7/130775528/72bb72b0c1.pdf
    • http://fawuwivel.denverdeckandfence.com/uploads/1/3/1/0/131071157/7507533.pdf
    • http://files.tiarrawiggs.com/uploads/1/3/1/8/131857305/wuroj-vuditipamitew.pdf
    • https://cdn.shopify.com/s/files/1/0434/3391/8616/files/property_manager_resume.pdf
    • https://cdn.shopify.com/s/files/1/0431/5322/7936/files/jojelesazedilifef.pdf
    • https://cdn.shopify.com/s/files/1/0438/9748/7512/files/13339097159.pdf
    • https://cdn.shopify.com/s/files/1/0432/6401/6539/files/16075170469.pdf
    • https://cdn.shopify.com/s/files/1/0428/8000/8355/files/polaxizakukunogusuwu.pdf
    • https://cdn.shopify.com/s/files/1/0428/8082/7558/files/45962652864.pdf
    • https://cdn.shopify.com/s/files/1/0430/3765/5191/files/32463923119.pdf
    • https://cdn.shopify.com/s/files/1/0438/1969/6290/files/breaking_free_from_ocd.pdf
    • https://cdn.shopify.com/s/files/1/0428/5097/5910/files/12868346030.pdf
    • https://cdn.shopify.com/s/files/1/0429/9092/8026/files/38554897131.pdf
    • https://cdn.shopify.com/s/files/1/0427/8976/5279/files/tukaduwadutuzubiwa.pdf
    • https://cdn.shopify.com/s/files/1/0437/0527/0427/files/baixar_creator_adobe.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004aea.bin
06bf91b1c130555f1789c368a3a4860182d572a1806b480407fc3d884c90f1e0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4AEA 5444 bytes
font_01_sfnt_off00005d5d.bin
892da781be3090ee9218e9f16fbc5c53e7b0e423e85b047e9d0e11449395208c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5D5D 11264 bytes
font_02_sfnt_off000080a9.bin
fbeccb1482ee56052ed809ec6cb7dfbc577d51b9212e43fffabc93e29761b6bf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x80A9 16248 bytes
font_03_sfnt_off000095fc.bin
cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34		 pdf-font-stream PDF embedded font (sfnt) at offset 0x95FC 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.