Malicious PDF — malware analysis report

Static analysis result for SHA-256 8e790ffd10a4ca7c…

MALICIOUS

PDF

53.6 KB Created: 2020-08-27 16:52:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0dfc69f819e8de4d1d7cf769873b5661 SHA-1: e1c988466d2f830ee6bf945c046c34a25730a9b5 SHA-256: 8e790ffd10a4ca7c70a54b7b71c9be48d8212896e917d1379e316d0e5ce55087
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links, many of which point to Shopify domains hosting other PDFs, forming a link farm. One critical heuristic indicates a malicious redirector link, specifically `https://ttraff.cc/pify?keyword=azar+app+gems+hack+apk`, which is likely the primary lure. The ML classifier strongly supports the malicious nature of this PDF. The document body, though heavily obfuscated, contains references to the malicious URL and other PDF links, reinforcing the lure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=azar+app+gems+hack+apk
    • http://zunibife.tuitionsutton.com/uploads/1/3/0/8/130814855/josalopixofiw-kalawuwira.pdf
    • https://cdn.shopify.com/s/files/1/0438/2018/7805/files/verimedulebe.pdf
    • https://cdn.shopify.com/s/files/1/0432/3174/0066/files/xevutexo.pdf
    • https://cdn.shopify.com/s/files/1/0432/3190/3902/files/klasifikasi_acetobacter_xylinum.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/2857609843.pdf
    • https://cdn.shopify.com/s/files/1/0429/6271/4773/files/bediwanine.pdf
    • https://cdn.shopify.com/s/files/1/0428/2915/2423/files/zokade.pdf
    • https://cdn.shopify.com/s/files/1/0436/3426/2169/files/vusijekimokupesemusovevax.pdf
    • https://cdn.shopify.com/s/files/1/0429/9338/5633/files/rifuximefobaziwiduj.pdf
    • https://cdn.shopify.com/s/files/1/0439/8268/4318/files/sukijikasilotapob.pdf
    • https://cdn.shopify.com/s/files/1/0434/3542/5944/files/29762637787.pdf
    • https://cdn.shopify.com/s/files/1/0433/7994/9718/files/83926395659.pdf
    • https://cdn.shopify.com/s/files/1/0432/8184/2341/files/dtv_channel_guide_2018.pdf
    • https://cdn.shopify.com/s/files/1/0431/0004/5465/files/modelo_neoliberal_en_chile.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_005_off0000a1af.bin
9aa840a55a3a17deb4022d3186d68964897da738085d4cae773c452b6cbb54fd		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xA1AF 22780 bytes
font_00_sfnt_off00006bd8.bin
e1874a174366618ac089d54a660f01273bd025eebb2f980177de56f98cf27d9f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6BD8 5420 bytes
font_01_sfnt_off00007e30.bin
2daa1b4877c17818a4fe934c4628187e45b55bd6940d391e123ab83ef29b933b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7E30 10288 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.