Malicious PDF — malware analysis report

Static analysis result for SHA-256 8bd6a1d32d453c4b…

MALICIOUS

PDF

52.3 KB Created: 2020-08-03 15:00:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 988c85bbfebc08d4ebc7512081f8eafd SHA-1: 86fff106a7204cf9d57de9b28a51c043c7382b4f SHA-256: 8bd6a1d32d453c4bdda52931be7574f7a25af43b3e6d39a178f7feb7a2565ada
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF document was flagged as malicious by a machine learning classifier and contains a large number of embedded links. One critical heuristic identified a PDF redirector link pointing to 'https://ttraff.ru/pify?keyword=l+aleph+borges+pdf+ita', and another identified a PDF link farm with 30 external links, many hosted on Shopify. The document body is heavily obfuscated but contains the redirector URL. This suggests the PDF is designed to lure users into clicking malicious links, likely leading to further malware downloads or phishing pages.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=l+aleph+borges+pdf+ita In PDF document text
    • http://files.poppyavenuecleanbeautybar.com/uploads/1/3/1/0/131070918/doduju.pdfIn PDF document text
    • http://files.jfwarner.com/uploads/1/3/0/7/130775912/4374844.pdfIn PDF document text
    • http://files.rmtdesigngroup.com/uploads/1/3/1/6/131606733/diwujutim_sodatiforirub.pdfIn PDF document text
    • http://files.rabbitstonedesigns.com/uploads/1/3/0/7/130740561/3362834.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0432/4671/5040/files/xejedixigunijagabemovudok.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0438/1822/1728/files/55502753958.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0433/7857/3464/files/gesujekinira.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0436/5680/6553/files/kejamaraxilex.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0428/8937/9993/files/5891159450.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0430/0469/0581/files/34424377953.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0432/2299/1007/files/latex_include.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0430/6305/0394/files/28529909959.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0432/6581/8789/files/twisted_treeline_rewards.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0434/8795/3053/files/bojijewatafisake.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0438/4551/7469/files/zimenafifonemuj.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/25843483079.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0435/5771/6117/files/61444308822.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008f3d.bin
3d015c0c4ce9bd2241aaccd53180ac7af642fe748ae482257d48265860970294		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8F3D 5384 bytes
font_01_sfnt_off0000a17b.bin
b5f1986e600a6fbf18151d5d56e7d63406aed81908b2e18cc6a22941e33db2a8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA17B 10744 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.