Malicious PDF — malware analysis report

Static analysis result for SHA-256 66ed5f9a1c236df8…

MALICIOUS

PDF

55.8 KB Created: 2020-08-10 12:31:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 62cbef16c58bfb061c1712c1687e22bf SHA-1: 94782aa7f3ed03330fca2cb755f6ee27a126e2de SHA-256: 66ed5f9a1c236df85ef03b53c0b991b5ab40a7052ce4ca9806b0350f5d609089
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links, many of which point to a link farm hosted on Shopify. One prominent link, identified as a malicious redirector, leads to 'ttraff.ru'. This suggests the document is designed to redirect users to potentially malicious content under the guise of providing educational notes. The ML classifier strongly supports the malicious nature of this PDF.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=bsc+2nd+year+maths+notes+pdf+download
    • http://kekiro.photosandburritos.com/uploads/1/3/1/3/131398140/pevorefeg_naperil_kelejebebisazob.pdf
    • http://files.leilahmoondances.com/uploads/1/3/1/3/131398097/tufafenimo_ganux.pdf
    • http://files.camiltyequestrian.co.uk/uploads/1/3/1/4/131455722/1f10d0.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fedorahosted.org/lohit
    • https://cdn.shopify.com/s/files/1/0433/8499/5991/files/37327348594.pdf
    • https://cdn.shopify.com/s/files/1/0429/2087/0044/files/basic_electrical_engineering_by_bl_theraja_free_download.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/nepel.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/nubizasijimowedemo.pdf
    • https://cdn.shopify.com/s/files/1/0438/8411/8171/files/vurid.pdf
    • https://cdn.shopify.com/s/files/1/0431/3631/9639/files/mezelimiz.pdf
    • https://cdn.shopify.com/s/files/1/0431/0165/1105/files/tinker_bell_2008.pdf
    • https://cdn.shopify.com/s/files/1/0431/8278/4676/files/basic_node_js_tutorial.pdf
    • https://cdn.shopify.com/s/files/1/0439/2468/4955/files/assurance_wireless_application_pennsylvania.pdf
    • https://cdn.shopify.com/s/files/1/0430/1737/1797/files/14009432827.pdf
    • https://cdn.shopify.com/s/files/1/0440/5601/9109/files/bakunin_anarchist_manifesto.pdf
    • https://cdn.shopify.com/s/files/1/0433/0972/7912/files/dawn_of_war_tau.pdf
    • https://cdn.shopify.com/s/files/1/0435/6574/4287/files/adjectives_and_adverbs_test.pdf
    • https://cdn.shopify.com/s/files/1/0428/5769/3347/files/58537594611.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006e35.bin
3ce488d2974eec8268a1548f9ccbbd8161cfcb2ebc5af726776bb12148eb14c4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6E35 5768 bytes
font_01_sfnt_off000081cd.bin
3c88888f84ed487a694278cc64b41cb0de609a764063a5dc2191361ac0f90572		 pdf-font-stream PDF embedded font (sfnt) at offset 0x81CD 2524 bytes
font_02_sfnt_off00008d0d.bin
6979bd47582e1076a00d5472c1190b3af330e4342ab9b9f0dc7d58f6ae02f5fc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8D0D 2576 bytes
font_03_sfnt_off00009800.bin
fdb58833c292de14b2ab5a9aa8936e916bd7cefe3c81536e00870c805d21a7d7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9800 10288 bytes
font_04_sfnt_off0000bb7a.bin
a4a01ac4f167cfabfbe33b329634bc3b93fbb7ff688aacf6b25378c5860e68b8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xBB7A 16260 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.