Malicious PDF — malware analysis report

Static analysis result for SHA-256 86d13ed7c43ef33e…

MALICIOUS

PDF

91.7 KB Created: 2020-09-17 06:38:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a27e2007790b1194af7a33e2fa6289e7 SHA-1: 2e4f0315d2abcd5c52f54db80ad1b347634dcb27 SHA-256: 86d13ed7c43ef33ec65b883b36709393ed353970aefa02635b421ee192e15e2e
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'ttraff.me'. The document body, though heavily obfuscated, contains the same URL and a lure related to 'Vampire Knight yuki death'. This indicates the PDF's primary purpose is to trick the user into visiting a malicious URL, likely for further exploitation or credential harvesting.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=vampire+knight+yuki+death
    • https://cdn.shopify.com/s/files/1/0447/9765/7248/files/betazok.pdf
    • https://cdn.shopify.com/s/files/1/0483/5750/7223/files/violin_open_strings_on_staff.pdf
    • https://cdn.shopify.com/s/files/1/0437/4613/2119/files/94092568862.pdf
    • https://fb00783e-3992-4750-8206-3dfd0144c340.filesusr.com/ugd/221eaa_6abd0f3415964528a9657a8502cd3116.pdf?index=true
    • https://54f9f257-0f6d-4658-8734-21da9459970c.filesusr.com/ugd/3d0627_8e43c4210b0a4ffb8bb2ac8dd80b1e77.pdf?index=true
    • https://7bf83921-0a9b-4e84-b153-bc191c53edab.filesusr.com/ugd/9c8fb9_e39f468619c042878a6d2d3af7890ee2.pdf?index=true
    • https://f09e8c65-6f86-4bc9-a684-ccaae10e3cbb.filesusr.com/ugd/c8683e_3a04438a6c0b476dbad3bc678da263cf.pdf?index=true
    • https://2d9f3f8c-af43-416d-bdc7-c23b679484d3.filesusr.com/ugd/c63dba_4e6c15ab3afa482fad21e2df1e8704dd.pdf?index=true
    • https://41af2bc5-8291-452b-89bf-d984c0f1f1d1.filesusr.com/ugd/1e8759_92843db618484547938400a1b244b303.pdf?index=true
    • https://6f3da1a6-f0c4-4584-9c2a-7db8e251850e.filesusr.com/ugd/bf0735_8c9a53911b6e44f28cfec7b5cc412b9c.pdf?index=true
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/xasojikunu.pdf
    • https://cdn.shopify.com/s/files/1/0465/4995/8806/files/87366851766.pdf
    • https://cdn.shopify.com/s/files/1/0438/6599/7472/files/better_business_5th_edition_download.pdf
    • https://cdn.shopify.com/s/files/1/0432/6876/7907/files/shoot_apical_meristem_pdf.pdf
    • https://cdn.shopify.com/s/files/1/0433/9659/5861/files/zifoso.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d0ae.bin
0789c88e10cb9d7cb6459f54ae6050c666ce05ec0656472aaaafd4e5e0f1602d
pdf-font-stream PDF embedded font (sfnt) at offset 0xD0AE 29808 bytes
font_01_sfnt_off00012ca2.bin
fd663887c9337a3254eb685ede54299f317359af2603c61d89b28fedcf5c1709
pdf-font-stream PDF embedded font (sfnt) at offset 0x12CA2 5292 bytes
font_02_sfnt_off00013e84.bin
87b4977d7ca04ca700b468329be62c4a4596c19ab893b3c3c05f7a9a0ff553dd
pdf-font-stream PDF embedded font (sfnt) at offset 0x13E84 10244 bytes