Malicious PDF — malware analysis report

Static analysis result for SHA-256 98bd9273c5a4b798…

MALICIOUS

PDF

40.5 KB Created: 2020-08-18 20:57:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b16cb8e25428a3867b1918d5e5a2cfbf SHA-1: 6c67f36ce67dfc1043a69b3a82ea479285160d87 SHA-256: 98bd9273c5a4b798cb4e51cf75b231396b85c4e8a74e72fcbd61117c12feb341
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a mass of external links, many pointing to potentially malicious redirectors. The primary malicious URL identified is https://ttraff.cc/pify?keyword=dexamethasone+classification+davis+drug+guide, which likely serves as a gateway to further malicious content. The document body, though heavily obfuscated, contains references to this URL and other PDF files hosted on various domains, suggesting a link farm or redirection scheme designed to distribute malware or lead to phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=dexamethasone+classification+davis+drug+guide
    • http://bejowenop.daleismopeners.com/uploads/1/3/1/4/131437254/2591284.pdf
    • http://files.thevintagebarntooele.com/uploads/1/3/1/8/131871704/bedilileduninekib.pdf
    • http://files.stcharlespilgrimages.com/uploads/1/3/1/4/131438500/0a599d3808.pdf
    • http://zabilu.gemenvironmental.org/uploads/1/3/1/4/131437594/e8075e871655dc1.pdf
    • http://files.grandbendsoccer.ca/uploads/1/3/1/8/131871894/mirelukexuger.pdf
    • https://cdn.shopify.com/s/files/1/0437/7932/6103/files/budiradediwuvikimefo.pdf
    • https://cdn.shopify.com/s/files/1/0432/9344/2208/files/11225917802.pdf
    • https://cdn.shopify.com/s/files/1/0432/8767/5036/files/12937760580.pdf
    • https://cdn.shopify.com/s/files/1/0433/9925/0081/files/51032229078.pdf
    • https://cdn.shopify.com/s/files/1/0430/8697/1029/files/gonawitowavivuva.pdf
    • https://cdn.shopify.com/s/files/1/0432/4684/6107/files/jotolumipirejeforul.pdf
    • https://cdn.shopify.com/s/files/1/0434/9450/6661/files/watimagubuzad.pdf
    • https://cdn.shopify.com/s/files/1/0429/6785/9359/files/bollywood_all_full_hd_mkv_movie.pdf
    • https://cdn.shopify.com/s/files/1/0432/0342/8510/files/xatoduvegezeka.pdf
    • https://cdn.shopify.com/s/files/1/0432/0568/9499/files/nalewegulovif.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005f80.bin
ca63f48456c26ebb5b7c6a9a2138f8969a37bc0f93462aa8f5318ccbb939ded0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5F80 5564 bytes
font_01_sfnt_off00007253.bin
08a9139e5f5f5f4ef71a08ad47ba19481ad23945e85ed3a4555d70da861e3b87		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7253 10228 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.