Malicious PDF — malware analysis report

Static analysis result for SHA-256 a10013b06b1dee67…

MALICIOUS

PDF

52.9 KB Created: 2020-09-02 01:45:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b754b23aab9ebf9174672db6e4a5b2d2 SHA-1: 54d896e3ee9ff3e3cb7554ba9908c5a95d7c624f SHA-256: a10013b06b1dee67ab3c96916cd7e32a82e6360960eae994bc4ff3d6fe702dfc
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by multiple critical heuristics for containing malicious redirector links and a large link farm. The embedded URL 'https://ttraff.me/wix?keyword=bongo+movies++madebe+lidai' is identified as a malicious redirector. The document body contains garbled text but also repeats the malicious URL, suggesting it is part of the lure. The presence of numerous links, many pointing to shopify.com, indicates a likely attempt to distribute spam or redirect users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=bongo+movies++madebe+lidai
    • https://cdn.shopify.com/s/files/1/0434/1504/4252/files/bupalek.pdf
    • https://cdn.shopify.com/s/files/1/0432/4392/9757/files/70633627302.pdf
    • https://cdn.shopify.com/s/files/1/0434/4116/0344/files/chapter_3_journalizing_transactions_application_problems_answers.pdf
    • https://cdn.shopify.com/s/files/1/0429/6779/3820/files/cultivo_de_cajanus_cajan.pdf
    • https://cdn.shopify.com/s/files/1/0438/7235/4459/files/37121648397.pdf
    • https://static.usrfiles.com/ugd/90661f_0cc85eac9b9d46e5933dd7d6ee784650.pdf
    • https://static.usrfiles.com/ugd/90661f_1f9cf09dc0424745a835cbe4d4fb5b56.pdf
    • https://static.usrfiles.com/ugd/81ef4b_b0b8594fac004a6d89cbb0e85cd59f78.pdf
    • https://static.usrfiles.com/ugd/d017d5_dcb8ed15bb6c4c73ab01692d4bc597c8.pdf
    • https://static.usrfiles.com/ugd/b8c837_e9f555f6009e4528b728fa103a567462.pdf
    • https://static.usrfiles.com/ugd/353d00_32821819d5b54f7eb35600dbfe73c274.pdf
    • https://static.usrfiles.com/ugd/b8c837_271cbeca9dab4340b6fc9ed23a2e7d22.pdf
    • https://static.usrfiles.com/ugd/b8c837_c8c1bc41e10746d79bf21bba238b3015.pdf
    • https://cdn.shopify.com/s/files/1/0429/9161/6153/files/danazaf.pdf
    • https://cdn.shopify.com/s/files/1/0433/4839/4143/files/72286145051.pdf
    • https://cdn.shopify.com/s/files/1/0431/8547/1656/files/gegomukijo.pdf
    • https://cdn.shopify.com/s/files/1/0436/0830/9923/files/nixaselokuviva.pdf
    • https://cdn.shopify.com/s/files/1/0431/6512/2720/files/jalavovumibe.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000629a.bin
31460b3f437d4e6978744fb465149c69acdd3fa8d54dfe4c1de13867abb9e2dd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x629A 5300 bytes
font_01_sfnt_off00007491.bin
ae97c3d355f7865818a2b03115060d85b839825ca793e030cfe078a17bfa7435		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7491 3300 bytes
font_02_sfnt_off00008103.bin
731cc787e18cef9715ae0624d4ac02f712e2ea1813873d226f61e0359c0b2d83		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8103 15428 bytes
font_03_sfnt_off0000b028.bin
355bd5a26ae3d97b7dc442372eb98810f64dbc01aaf61553623db8f8e880351c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB028 16384 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.