Malicious PDF — malware analysis report

Static analysis result for SHA-256 a076e5124bda6cfe…

MALICIOUS

PDF

39.4 KB Created: 2020-09-18 04:56:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: dd3d4c28164f51fea2b8c23fea0c9c8e SHA-1: f233331d3aa78b970f73b8be7b3e5a5a5b510a58 SHA-256: a076e5124bda6cfe5588940da260679aa9799f2e8fb6d4938c5ad0cb97e7f57e
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains numerous embedded links, with a critical heuristic identifying a link to a known malicious redirector at 'https://ttraff.me/wix?keyword=mine+blocks+games+free'. Another heuristic indicates a PDF link farm, with the first URL being 'https://cdn.shopify.com/s/files/1/0431/4641/2188/files/palunokimuposaken.pdf'. The ML classifier strongly flagged this PDF as malicious. The document body, though heavily obfuscated, contains references to 'mine blocks games free' and the malicious URL, suggesting a lure for potentially malicious content or scams.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=mine+blocks+games+free
    • https://cdn.shopify.com/s/files/1/0431/4641/2188/files/palunokimuposaken.pdf
    • https://cdn.shopify.com/s/files/1/0431/8108/0738/files/13660161031.pdf
    • https://cdn.shopify.com/s/files/1/0459/9044/5213/files/annexure_d_for_pan_card.pdf
    • https://cdn.shopify.com/s/files/1/0431/1092/4437/files/control_system_theory_book.pdf
    • https://cdn.shopify.com/s/files/1/0434/3876/8294/files/54148744616.pdf
    • https://cdn.shopify.com/s/files/1/0434/7245/3797/files/51391911705.pdf
    • https://cdn.shopify.com/s/files/1/0437/1457/6538/files/rageniwizalusewetisowopad.pdf
    • https://cdn.shopify.com/s/files/1/0434/0118/3384/files/bike_racing_car_game.pdf
    • https://cdn.shopify.com/s/files/1/0437/3502/3765/files/all_decepticons_in_transformers_2.pdf
    • https://cdn.shopify.com/s/files/1/0430/8526/7097/files/ruxisufadivi.pdf
    • https://288d8aef-e027-4ed3-b389-9e735570caeb.filesusr.com/ugd/80fd5d_557dc224fa564ee595a3329e1d3b91cb.pdf?index=true
    • https://ead4847c-fb5b-4b92-b3ec-84dd482e26d1.filesusr.com/ugd/65d6f7_7275a0ff88764eea9ce35983271eb9f1.pdf?index=true
    • https://cdn.shopify.com/s/files/1/0434/0878/5562/files/35511629706.pdf
    • https://cdn.shopify.com/s/files/1/0436/0824/4381/files/the_duke_tommy_emmanuel_tutorial.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004e40.bin
ce4ce39dc39d217f0bb6350147760edc81a4270896bf00a6d03d08e35d1dadf8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4E40 5116 bytes
font_01_sfnt_off00005f85.bin
5e3a66c2e3d337ab2c530b3d65d279d7003447963bb3581a3040050ccb798fc0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5F85 10352 bytes
font_02_sfnt_off000082e9.bin
d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378		 pdf-font-stream PDF embedded font (sfnt) at offset 0x82E9 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.