Malicious PDF — malware analysis report

Static analysis result for SHA-256 83da61e246597f44…

MALICIOUS

PDF

100.0 KB Created: 2020-08-14 05:31:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e62ded35d03b0ac8096163d25f562d8d SHA-1: 8dd585688c164eb2082c945336e2258a3c7d9cd4 SHA-256: 83da61e246597f4468cdb6cf7fcb1ab97b1ae3fc01d5be2ab947c69db560a729
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Phishing: Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a link to a known malicious redirector, ttraff.ru, which is presented as a lure for movie subtitles. The document also exhibits characteristics of a link farm, with numerous embedded URLs pointing to external resources, many of which are hosted on cdn.shopify.com. The ML classifier strongly indicated maliciousness, supporting the conclusion that this PDF is designed to redirect users to harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9836

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=nightmare+cinema+subtitles
    • http://files.gietal.net/uploads/1/3/1/8/131857305/lupitefi-paxababejepawuz-zanedekan.pdf
    • http://nixeve.cfpleasanthill.org/uploads/1/3/0/7/130739430/c4ffdac0a9546.pdf
    • http://files.theclaytonconnection.com/uploads/1/3/2/6/132682897/wilidajo.pdf
    • http://kijon.outhustleathletics.com/uploads/1/3/0/7/130775436/9efab555b33d3eb.pdf
    • http://files.goringgaphistory.org.uk/uploads/1/3/1/4/131409761/bec739d7.pdf
    • https://cdn.shopify.com/s/files/1/0434/1415/9521/files/87840025583.pdf
    • https://cdn.shopify.com/s/files/1/0433/8148/9813/files/5701728191.pdf
    • https://cdn.shopify.com/s/files/1/0453/6067/7019/files/limiting_adjectives_worksheet_4th_grade.pdf
    • https://cdn.shopify.com/s/files/1/0433/4977/0389/files/xejutigodifejitelijet.pdf
    • https://cdn.shopify.com/s/files/1/0437/6661/2130/files/libro_de_mario_benedetti.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/28650507632.pdf
    • https://cdn.shopify.com/s/files/1/0431/7849/2072/files/56429490678.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/femepotufitaxaturu.pdf
    • https://cdn.shopify.com/s/files/1/0437/3191/0821/files/92780054389.pdf
    • https://cdn.shopify.com/s/files/1/0441/3220/4696/files/37860757805.pdf
    • https://cdn.shopify.com/s/files/1/0432/8164/5736/files/sonic_express_labler.pdf
    • https://cdn.shopify.com/s/files/1/0435/8583/1070/files/ayyappa_swamy_photos.pdf
    • https://cdn.shopify.com/s/files/1/0432/2135/2606/files/korean_learning_books_free_download.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 16

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_016_off00013f8a.bin
2f0f80db9e8871d083fdcf24edaea7760edc574062ef06e3d78c75733e5b8771		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x13F8A 18892 bytes
font_00_sfnt_off0000683d.bin
2e595141cfc5a730015d867094056734cd151f5b215480bba884d522f17c5808		 pdf-font-stream PDF embedded font (sfnt) at offset 0x683D 7916 bytes
font_01_sfnt_off00007c9d.bin
9440f71eefa4f59c7a71b16fb0b9f65724f2db68f71ee41650680a98f027c4b0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7C9D 4032 bytes
font_02_sfnt_off00008b0e.bin
27acf31d1a338b8700f2f904f02b892ba6f4d271c834849c0bc669218e12e0ce		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8B0E 5092 bytes
font_03_sfnt_off00009c2d.bin
ff8289fcab20b7b81f5dc7c47458689637225d7099c48932a46d6898d6123f6c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9C2D 2656 bytes
font_04_sfnt_off0000a732.bin
2a2f73c0ee504ae8509221dab9a50e72e6c400a18e3952d3eee660ba18a0c3b1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA732 4140 bytes
font_05_sfnt_off0000b44f.bin
b5c6b6e0c9ada0bf1c6b02372d38a6194b0fc304f51b15768a03b7bd417def48		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB44F 3048 bytes
font_06_sfnt_off0000c05e.bin
18b250f24057ce91e4a59b25c1eec79fa8b4d7e2cb9f6c0de02c7e032a072fd4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC05E 2328 bytes
font_07_sfnt_off0000cb15.bin
5fd53e2058c4f5d98b70161d670f1e42036942552fef68ac845a5e47e2d7f715		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCB15 2604 bytes
font_08_sfnt_off0000d5f7.bin
5b8e8035f8940535bfb5f3d78de7d5c45dbc51c905faa5d9788b8fc152e96872		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD5F7 3840 bytes
font_09_sfnt_off0000e40c.bin
5fc9e2cd4e7ad04544edda2023dd698132b65daf167a61e09de9fd8de66d8b52		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE40C 2108 bytes
font_10_sfnt_off0000edea.bin
87016e8933cc862d1d188edfbee698abcff8178ed3d6b510b61737ee02f60284		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEDEA 4336 bytes
font_11_sfnt_off0000fb8a.bin
488ffee5e9c33bcc1f3f00aec749f35977d0cdd209ffadaee35194d66ecc177d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFB8A 6148 bytes
font_12_sfnt_off00010b74.bin
4f938f50ab0df544c0759823802871915842ac3dfaa997d4ed664bd16f780f0f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10B74 16824 bytes
font_14_sfnt_off00015eb0.bin
ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15EB0 4324 bytes
font_15_sfnt_off00016cbc.bin
0a763f02db1d1c5d34f23894b7a4af96ea2433ab124f48894d552220baaa19fc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16CBC 3536 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.