Malicious PDF — malware analysis report

Static analysis result for SHA-256 80df6852729b73fe…

MALICIOUS

PDF

44.7 KB Created: 2020-08-12 18:48:19 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9a484f102c9a017daea7ec24fd57ca15 SHA-1: e7794f43843f75cc162d4ff4fd613ea068f182f6 SHA-256: 80df6852729b73febdaf4b64a86edcd0532c97a2b38fb013206d5f339508212d
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a significant number of embedded links, with a critical heuristic firing indicating it's a malicious redirector. The primary URL, 'https://ttraff.cc/pify?keyword=canceles+de+aluminio+pdf', is identified as a malicious redirector. The document body is heavily obfuscated and contains what appears to be junk data, but the embedded URL is clearly visible. The presence of numerous links, many hosted on Shopify, suggests a link farm or SEO poisoning tactic to distribute malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=canceles+de+aluminio+pdf
    • http://files.everythingipromisedyouisbeingsold.com/uploads/1/3/0/8/130814056/484c8f3fc.pdf
    • http://files.flagsnmore.com/uploads/1/3/0/7/130740568/venimenurator.pdf
    • http://tavixek.uffnofd.com/uploads/1/3/1/4/131453133/teruwobuxinatewetoj.pdf
    • https://cdn.shopify.com/s/files/1/0431/7177/4615/files/71359851416.pdf
    • https://cdn.shopify.com/s/files/1/0428/8918/3398/files/29370783674.pdf
    • https://cdn.shopify.com/s/files/1/0432/0450/9853/files/wubawabixavipone.pdf
    • https://cdn.shopify.com/s/files/1/0428/7250/4483/files/30828497412.pdf
    • https://cdn.shopify.com/s/files/1/0435/3284/5207/files/55102018192.pdf
    • https://cdn.shopify.com/s/files/1/0434/9476/8792/files/2438090576.pdf
    • https://cdn.shopify.com/s/files/1/0431/5922/4480/files/51066841210.pdf
    • https://cdn.shopify.com/s/files/1/0438/4499/3181/files/20261366425.pdf
    • https://cdn.shopify.com/s/files/1/0434/5207/2086/files/16598219932.pdf
    • https://cdn.shopify.com/s/files/1/0431/2816/0420/files/lelekefiburitu.pdf
    • https://cdn.shopify.com/s/files/1/0429/8611/1137/files/wivebonamugixataxesesusu.pdf
    • https://cdn.shopify.com/s/files/1/0439/2088/3880/files/kosoxadelalu.pdf
    • https://cdn.shopify.com/s/files/1/0428/7237/3414/files/zurexifadarolifoninik.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/86593634255.pdf
    • https://cdn.shopify.com/s/files/1/0434/7111/0310/files/congenital_heart_disease_textbook.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006344.bin
4c6593f5c057f1d623deaf27420a32c1502a01796c703e788abf67d60ef76b20
pdf-font-stream PDF embedded font (sfnt) at offset 0x6344 5108 bytes
font_01_sfnt_off0000748e.bin
ce46aa1dbbc5d4ccff2bc18f261f922d4989b70dbc3b0e65edccaa0f98527a2d
pdf-font-stream PDF embedded font (sfnt) at offset 0x748E 2028 bytes
font_02_sfnt_off00007e14.bin
6a8768a328151792d2d75c04bb6b1c94c4cd4d71cfbf84588b08c8757641016e
pdf-font-stream PDF embedded font (sfnt) at offset 0x7E14 11668 bytes