Malicious PDF — malware analysis report

Static analysis result for SHA-256 93160c9c2ee3fd0b…

MALICIOUS

PDF

47.4 KB Created: 2020-08-30 22:56:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0318a21e987bf83eec79b4da77d1e16d SHA-1: 836d29dbe8d3f95df8336934102de02d3a6afef0 SHA-256: 93160c9c2ee3fd0b4a93d9f076b5f434d1ef3f0df02f26f6af89f85c75318a8d
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.001 Malicious Link

The PDF contains a malicious redirector link pointing to 'https://ttraff.com/wix?keyword=service+manual+pdf+download', which is flagged as malicious. Additionally, the document exhibits characteristics of a PDF SEO link farm, with numerous links to external PDFs hosted on platforms like Shopify. The ML classifier strongly indicates maliciousness. The primary attack vector appears to be social engineering through a deceptive download lure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=service+manual+pdf+download
    • https://cdn.shopify.com/s/files/1/0428/2620/3302/files/fusiwevegosepupadoludum.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/32377204601.pdf
    • https://cdn.shopify.com/s/files/1/0433/6248/4383/files/96029254240.pdf
    • https://cdn.shopify.com/s/files/1/0435/9258/1283/files/la_republica_de_platon.pdf
    • https://cdn.shopify.com/s/files/1/0431/7786/9476/files/wekimonorekup.pdf
    • https://cdn.shopify.com/s/files/1/0427/6014/3014/files/66491155723.pdf
    • https://cdn.shopify.com/s/files/1/0428/8688/9625/files/65567363846.pdf
    • https://cdn.shopify.com/s/files/1/0430/5407/1957/files/download_wattpad_stories.pdf
    • https://cdn.shopify.com/s/files/1/0432/5107/3174/files/luvifatetiruwugowana.pdf
    • https://static.usrfiles.com/ugd/97aff7_3e9b94657e27422c9349a3171191edaf.pdf
    • https://static.usrfiles.com/ugd/b8c837_d7d4c758886f40a9b6d0af59fc2fe025.pdf
    • https://static.usrfiles.com/ugd/b8c837_6573bfaeffc24253bee62bc962877ac2.pdf
    • https://static.usrfiles.com/ugd/b8c837_49125088aa2249d98fcd5d7697daa921.pdf
    • https://cdn.shopify.com/s/files/1/0429/7529/7689/files/20885727469.pdf
    • https://cdn.shopify.com/s/files/1/0437/6710/3645/files/17105669970.pdf
    • https://cdn.shopify.com/s/files/1/0435/9811/9075/files/jelitawono.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007a38.bin
f776ca182eb9457c9525c0ac36820f40b8514aa604629d8ab5c4e844068ab902		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7A38 5380 bytes
font_01_sfnt_off00008c7b.bin
240348809221a16f381fb9fe5a1b7781a0727d900f282e556e4462b02d30ce86		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8C7B 10536 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.