Malicious PDF — malware analysis report

Static analysis result for SHA-256 7d4bb4f82cdf282c…

MALICIOUS

PDF

42.2 KB Created: 2020-08-24 13:47:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e6b3421a66fd1fe43a6a9f72617b31f2 SHA-1: 8a8fc167281be70bd124fda042cdee7d144962d9 SHA-256: 7d4bb4f82cdf282c2d56bac1cde19be857ef75886f49885f91d2c8bb71555297
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains numerous embedded links, with one identified as a malicious redirector. The document body, though partially corrupted, contains the URL 'https://ttraff.ru/pify?keyword=cuadro+medico+asisa+cordoba+2018+pdf', which is flagged as malicious. The presence of a link farm heuristic further supports the malicious intent of distributing traffic to external sites. No scripts were extracted, but the PDF structure itself is used to facilitate the malicious redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=cuadro+medico+asisa+cordoba+2018+pdf
    • http://gadofov.snowypeaksoap.com/uploads/1/3/0/7/130775626/6776511.pdf
    • http://files.griffithspropertymanagement.com/uploads/1/3/1/4/131453060/7931377.pdf
    • http://files.regencyparkcary.com/uploads/1/3/0/8/130874587/1544936.pdf
    • http://files.prairiefirebordercollies.com/uploads/1/3/1/1/131164202/841647.pdf
    • http://gupodaxi.blackpeakstudio.com/uploads/1/3/1/4/131406082/01865a565cc27.pdf
    • https://cdn.shopify.com/s/files/1/0433/8958/3514/files/jenadugegazuxurilevudo.pdf
    • https://cdn.shopify.com/s/files/1/0437/6382/6849/files/86992168410.pdf
    • https://cdn.shopify.com/s/files/1/0429/5085/2762/files/youtube_link_full_screen_autoplay.pdf
    • https://cdn.shopify.com/s/files/1/0433/0435/3956/files/62582035630.pdf
    • https://cdn.shopify.com/s/files/1/0433/9754/6149/files/27667594508.pdf
    • https://cdn.shopify.com/s/files/1/0433/1647/8110/files/buloxolojixepowos.pdf
    • https://cdn.shopify.com/s/files/1/0434/9159/0308/files/zebetiwati.pdf
    • https://cdn.shopify.com/s/files/1/0429/1064/6435/files/73747989923.pdf
    • https://cdn.shopify.com/s/files/1/0427/6633/6166/files/71975416390.pdf
    • https://cdn.shopify.com/s/files/1/0433/0763/0747/files/20217501568.pdf
    • https://cdn.shopify.com/s/files/1/0432/6447/5299/files/vidozozafaba.pdf
    • https://cdn.shopify.com/s/files/1/0431/5840/5275/files/gixakazoredufa.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000054a6.bin
326b0d96df17f210fddf3372fa55834614c9f88d1b6a6395b972d29211cd77fc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x54A6 5648 bytes
font_01_sfnt_off000067da.bin
d83b2edffd91c404d4bd8afef71f8733a866965fdebf62b62b975e4a272e4b6a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x67DA 11164 bytes
font_02_sfnt_off00008bde.bin
b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8BDE 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.