Malicious PDF — malware analysis report

Static analysis result for SHA-256 7c31c6ed29c2d475…

MALICIOUS

PDF

57.8 KB Created: 2020-08-19 03:59:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bba7ba83b1ef757739e175ef1d4f7ae4 SHA-1: dae75c7756fd30c726252cfa2a31c128cb58cfc6 SHA-256: 7c31c6ed29c2d4754a0dd6c097df6b95c505c71d3e36552f421e5856150cc7ec
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'https://ttraff.com/pify?keyword=khatu+shyam+ji+bhajan++mp4'. Additionally, it exhibits characteristics of a PDF link farm, with numerous external links, including one to 'https://cdn.shopify.com/s/files/1/0440/7531/9448/files/zumikobizisako.pdf'. The ML classifier also flagged this PDF with high confidence. The document body contains the malicious URL, suggesting an attempt to lure the user to a potentially harmful site.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=khatu+shyam+ji+bhajan++mp4
    • http://files.randolphroadrunners.org/uploads/1/3/1/3/131383743/jarexunuzutelemufa.pdf
    • http://files.spoonful-osaji.com/uploads/1/3/0/7/130775163/wuzag.pdf
    • http://bulexuso.paulashbyjohnsonphotography.co.uk/uploads/1/3/1/6/131606289/e798e56.pdf
    • http://files.thecuteheifer.com/uploads/1/3/0/7/130775866/jubusugez.pdf
    • http://files.trevoroc.com/uploads/1/3/0/7/130775892/patedakolugoz_papewimefa_lulezolax_kuvurukawewopu.pdf
    • http://files.randolphroadrunners.org/uploads/1/3/1/3/13138374
    • https://cdn.shopify.com/s/files/1/0440/7531/9448/files/zumikobizisako.pdf
    • https://cdn.shopify.com/s/files/1/0436/5792/0677/files/towelapevewes.pdf
    • https://cdn.shopify.com/s/files/1/0434/6488/4384/files/pikakokugi.pdf
    • https://cdn.shopify.com/s/files/1/0434/9424/4516/files/miocardiopata_hipertrofica.pdf
    • https://cdn.shopify.com/s/files/1/0432/4543/7083/files/libertarian_party_platform.pdf
    • https://cdn.shopify.com/s/files/1/0437/3826/7809/files/93870636605.pdf
    • https://cdn.shopify.com/s/files/1/0434/0737/6542/files/jiwagitibuniwizativoj.pdf
    • https://cdn.shopify.com/s/files/1/0432/3518/0703/files/mibonu.pdf
    • https://cdn.shopify.com/s/files/1/0433/8070/3399/files/99198995010.pdf
    • https://cdn.shopify.com/s/files/1/0431/8488/1824/files/21326287082.pdf
    • https://cdn.shopify.com/s/files/1/0433/5733/9813/files/angular_default_value_form.pdf
    • https://cdn.shopify.com/s/files/1/0433/8548/7516/files/66542175097.pdf
    • https://cdn.shopify.com/s/files/1/0428/1889/6038/files/zofefotivedilezikus.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000733e.bin
87d073295601bb18bd4d0fc6f871bb6511f264a0ce9863a342ee468ed8df8baa		 pdf-font-stream PDF embedded font (sfnt) at offset 0x733E 5304 bytes
font_01_sfnt_off0000853e.bin
6682146cbb709c07d3e1b0a24cc6c957c925e3c9ff2e590833eacb5341d3ddad		 pdf-font-stream PDF embedded font (sfnt) at offset 0x853E 14776 bytes
font_02_sfnt_off0000b357.bin
532315dfdc59b350d447ad91845dd8cc72a836e684f536ab9a4305dc5b53fb8e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB357 16204 bytes
font_03_sfnt_off0000c8c3.bin
c94c48e39de9820f6d2c4dfe1eee7d20d77933d0e0b74c79b11010a14d45ae50		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC8C3 4564 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.