Malicious PDF — malware analysis report

Static analysis result for SHA-256 934af09cb1046070…

MALICIOUS

PDF

36.9 KB Created: 2020-08-12 15:23:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a08aecea756820cd4f049ab7bb4357fe SHA-1: d880761b7fc48d9ddb5f976515a3ebce99917adf SHA-256: 934af09cb10460700d64f28dd01ca4aefe57d9a1166c9b4929d0c8664e2af415
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a link to a known malicious redirector, ttraff.com, which is a strong indicator of malicious intent. The document also exhibits characteristics of a PDF SEO link farm, with numerous links to external PDFs, many hosted on Shopify. The ML classifier also flagged this PDF with high confidence. The primary attack pattern involves luring the user to the malicious redirector, likely for subsequent phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=bar+louie+menu+pdf
    • http://files.claudiacait.com/uploads/1/3/1/4/131482828/tesugozisokiwom-revuluweri-kegexibipun-vevenubat.pdf
    • http://lisuwe.exodusads.com/uploads/1/3/1/3/131383483/f4a65d47853e8cf.pdf
    • http://files.bradleyhughesgolfforum.com/uploads/1/3/1/4/131409755/kafejato-giripisof-lulirifunexupu-dogetalita.pdf
    • http://xuneb.srphotographymelbourne.com.au/uploads/1/3/0/7/130739919/1773941.pdf
    • http://xibuko.witskenlandscaping.com/uploads/1/3/1/4/131438003/widoki.pdf
    • https://cdn.shopify.com/s/files/1/0437/1575/6181/files/install_virtualenv_mac.pdf
    • https://cdn.shopify.com/s/files/1/0433/2417/8600/files/35476557077.pdf
    • https://cdn.shopify.com/s/files/1/0429/4436/4710/files/6324266200.pdf
    • https://cdn.shopify.com/s/files/1/0434/3355/8168/files/sobuxibiwaxoj.pdf
    • https://cdn.shopify.com/s/files/1/0431/5162/2306/files/vekodazosilatetol.pdf
    • https://cdn.shopify.com/s/files/1/0435/5679/8615/files/69276922821.pdf
    • https://cdn.shopify.com/s/files/1/0438/7281/3211/files/3d_shapes_and_their_names.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/fonufefijosogigu.pdf
    • https://cdn.shopify.com/s/files/1/0429/9636/7511/files/list_of_bible_stories_from_genesis_to_revelation.pdf
    • https://cdn.shopify.com/s/files/1/0432/3000/3358/files/sijevawuxepebalojeritanu.pdf
    • https://cdn.shopify.com/s/files/1/0432/3436/1503/files/sofugolemuxutiloni.pdf
    • https://cdn.shopify.com/s/files/1/0452/5110/0829/files/allahabad_state_university_ba_time_table_2020_download.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005269.bin
73b7f7c8577cd26368e3a436489614d119c47d427c8f11a797bb13e6f64f3c5d
pdf-font-stream PDF embedded font (sfnt) at offset 0x5269 5056 bytes
font_01_sfnt_off00006385.bin
cf9b106302f366d2407dd82c3a9d2dc519c80bbad883aa3fcc69bd8dc14e10a9
pdf-font-stream PDF embedded font (sfnt) at offset 0x6385 10368 bytes