Malicious PDF — malware analysis report

Static analysis result for SHA-256 87f264110a0d632a…

MALICIOUS

PDF

55.4 KB Created: 2020-08-31 10:41:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 20ff706278b5a96c238c42a46001fd0b SHA-1: 657b4cad5e4048a2027ee70c7acdc12d8cafd152 SHA-256: 87f264110a0d632a4fb859f9c001c6aaef537c78129bece7d2d55f23a396b376
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a critical heuristic firing for a malicious redirector link, specifically pointing to 'https://ttraff.ru/wix?keyword=diary+of+a+wimpy+kid+number+8'. This URL is presented within the document body, disguised as a link to a children's book. The presence of a large number of external PDF links, many pointing to benign content, suggests a link farm or SEO poisoning technique to mask the malicious redirector. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=diary+of+a+wimpy+kid+number+8
    • https://static.usrfiles.com/ugd/ae059d_968c44304dc5433c91cdcf863a4a6b8d.pdf
    • https://static.usrfiles.com/ugd/b8c837_58492f66ab424fb8bc72b81a71a7c012.pdf
    • https://static.usrfiles.com/ugd/b8c837_1aded51d82f9451180751f834194fa37.pdf
    • https://static.usrfiles.com/ugd/df4650_e27ec99f19b94c788d8c3a727bcc6153.pdf
    • https://static.usrfiles.com/ugd/b8c837_fd0d0913464c447e8d33514485477726.pdf
    • https://cdn.shopify.com/s/files/1/0428/9203/4211/files/didi_chuxing_annual_report_2018.pdf
    • https://cdn.shopify.com/s/files/1/0444/3507/9335/files/farufizoxapivujanenivi.pdf
    • https://cdn.shopify.com/s/files/1/0428/5782/4415/files/campingaz_party_grill_400_cv_manual.pdf
    • https://cdn.shopify.com/s/files/1/0438/3942/2626/files/33686180691.pdf
    • https://static.usrfiles.com/ugd/20d83a_db13917c5fc6441f8981e2c71d2dd287.pdf
    • https://static.usrfiles.com/ugd/105a8c_519331950de74b96b38d9410e287ceda.pdf
    • https://static.usrfiles.com/ugd/f3ecbe_e19cb74c847c4695a1a9c286c37321df.pdf
    • https://static.usrfiles.com/ugd/b8c837_6504dbaef53b4a92b8b6a21fe0bc7393.pdf
    • https://static.usrfiles.com/ugd/b8c837_52b1f7723aae4e51b8b7a0f5db87dec4.pdf
    • https://static.usrfiles.com/ugd/fe83c3_570157ac8ea94fd6925bf536ad198f45.pdf
    • https://static.usrfiles.com/ugd/b8c837_0e2117e68b004dbc897498a972b48566.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://static.usrfiles.com/ugd/b8c837_

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00009bb0.bin
594fc9af4b45b60ff29214c4b18773aaa54162e197bfe50373c0477e8afc2a67		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9BB0 5568 bytes
font_01_sfnt_off0000aea6.bin
5301b8fef414d453233c32f44447ef4b8337ada0fe1dd618e4039b0b6d09e951		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAEA6 9844 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.