Malicious PDF — malware analysis report

Static analysis result for SHA-256 58e665dec85ec857…

MALICIOUS

PDF

40.8 KB Created: 2020-08-22 02:52:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 999f7f5407ba957492235384ce10b8d2 SHA-1: 7df8d334c99e9ceab56994dd4646e1431d11ea72 SHA-256: 58e665dec85ec8570e47a5b27a9a2553556222f13088676af0ff8b293d92cc89
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links, many pointing to Shopify domains, but one critical link redirects to a known malicious infrastructure at 'ttraff.ru'. The document body, though heavily obfuscated, contains the same malicious URL and appears to be a lure for 'conditionals exercises'. The ML classifier strongly indicates maliciousness, and the PDF_SEO_LINK_FARM heuristic suggests a link farm designed to distribute malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=conditionals+exercises+multiple+choice+pdf+with+answers
    • http://kumuge.annemurrayartist.com/uploads/1/3/0/7/130775164/sarotubuji.pdf
    • http://xuralo.38plus2productions.com/uploads/1/3/1/3/131398177/nejuwisugobad.pdf
    • http://files.heccstl.com/uploads/1/3/0/7/130775727/5319829.pdf
    • https://cdn.shopify.com/s/files/1/0434/6963/5734/files/accountant_sample_resume.pdf
    • https://cdn.shopify.com/s/files/1/0440/3465/4358/files/soil_nematodes.pdf
    • https://cdn.shopify.com/s/files/1/0434/8801/8598/files/21433696705.pdf
    • https://cdn.shopify.com/s/files/1/0435/9448/1821/files/vadurapokezum.pdf
    • https://cdn.shopify.com/s/files/1/0435/1560/9243/files/calidad_de_vida_definicion_oms.pdf
    • https://cdn.shopify.com/s/files/1/0433/2378/5370/files/sifanegoraguje.pdf
    • https://cdn.shopify.com/s/files/1/0436/4032/4256/files/critical_path_method_sample_questions_and_answers.pdf
    • https://cdn.shopify.com/s/files/1/0465/5418/5878/files/jisiripagip.pdf
    • https://cdn.shopify.com/s/files/1/0432/2410/5124/files/sudibibakexutod.pdf
    • https://cdn.shopify.com/s/files/1/0451/9664/0407/files/el_procedimiento_monitorio_piero_calamandrei.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004b63.bin
69843c63bd3c04187dcc65550fe9cdb65b2c7f4a9c2e2976c4fb574db74f9812		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4B63 5460 bytes
font_01_sfnt_off00005dde.bin
899ab8f36eb8be7265246f7a720edfbd010afb3f5ada43901bdb59d50d6beb6b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5DDE 10204 bytes
font_02_sfnt_off00008103.bin
bb4620ae2308066493f479cb0495314a41e91f5b0bfb2a754d9bad2ef34af03d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8103 16060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.