Malicious PDF — malware analysis report

Static analysis result for SHA-256 82dcf901671aca24…

MALICIOUS

PDF

58.9 KB Created: 2020-07-11 12:23:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bfcbe199c31e1115559a7ac2ee642d53 SHA-1: b91f36f8707889fb3a1f549b72f0528efbecd257 SHA-256: 82dcf901671aca246fc5f82d267041a6769cecf140cc70a244872e33f882c75e
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links, many of which point to domains associated with link farms and redirectors. The primary URL, https://ttraff.ru/pify?keyword=akaso+v50+elite+manual+espa%25C3%25B1ol, is a clear indicator of malicious redirection. The document body, though heavily obfuscated, contains this same URL, suggesting it's the intended destination. The heuristic firings confirm the presence of malicious redirector links and a link farm.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=akaso+v50+elite+manual+espa%25C3%25B1ol
    • http://files.operationhelpahero.org/uploads/1/3/1/4/131453531/tovaxe.pdf
    • http://files.discoverbellville.com/uploads/1/3/2/8/132815008/6d26d7.pdf
    • http://files.haralsoncountyhistory.com/uploads/1/3/2/3/132302913/4438840.pdf
    • http://files.nancytangles.com/uploads/1/3/0/7/130740480/lazenumigulub_wusemizigiduzi_bulafikozomat_webudob.pdf
    • http://files.exmouthcaninecentre.co.uk/uploads/1/3/0/8/130874128/jenasaj.pdf
    • http://files.warrencountyfoundation.org/uploads/1/3/0/9/130969702/fetiseruxokonujan.pdf
    • http://files.thesearenotmygrandkids.com/uploads/1/3/0/7/130739153/6176ee93d34.pdf
    • http://files.internationalschoolhealth.org/uploads/1/3/0/8/130813395/56a209b6.pdf
    • http://files.706wrestling.com/uploads/1/3/1/8/131856041/punubebik-sasafat-bukav.pdf
    • https://vogajakojoge.files.wordpress.com/2020/06/83585333664.pdf
    • https://luribaw.files.wordpress.com/2020/07/34593484396.pdf
    • https://dujufapuji.files.wordpress.com/2020/07/sotesezuzulepopimuv.pdf
    • https://birefafaj.files.wordpress.com/2020/07/xevejozo.pdf
    • https://memibenamefu.files.wordpress.com/2020/06/jisipuwowonokor.pdf
    • https://cdn.shopify.com/s/files/1/0427/7754/2823/files/kapulelofadoluxivugun.pdf
    • https://cdn.shopify.com/s/files/1/0427/7708/4070/files/67306973534.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/45366335679.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/25322908130.pdf
    • https://cdn.shopify.com/s/files/1/0430/4610/9341/files/30095345587.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/35022180152.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/3502

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000075b3.bin
ffeb89eaad713c9717385028f79c9757067aafb2c2382ea8cbab0e6efe35a425		 pdf-font-stream PDF embedded font (sfnt) at offset 0x75B3 6744 bytes
font_01_sfnt_off0000869b.bin
38103b54e6885d25d0eb105aa3f5fe986bf122a1573b4f35f7dbaee06826c631		 pdf-font-stream PDF embedded font (sfnt) at offset 0x869B 5340 bytes
font_02_sfnt_off0000986d.bin
8b88185fb1caa19b127db774f1e773b8ec41d1394bc7b72cd727186061f48d9d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x986D 2248 bytes
font_03_sfnt_off0000a2c0.bin
c7458a2e2938ae5d404958f3553e45213207881157bfe5d464a6e89d0d274057		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA2C0 10644 bytes
font_04_sfnt_off0000c66a.bin
8ba0fbd8692d35223d61c2001725969a2fa72841f4eb16d427b35f7f26732cf1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC66A 16116 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.