Malicious PDF — malware analysis report

Static analysis result for SHA-256 a3678ae1ea602067…

MALICIOUS

PDF

45.0 KB Created: 2020-09-17 10:38:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 102bc4eed0a17e81296039198eb59368 SHA-1: d76bdd6061d0903a9f0aa0fa5820857cfb3ab2f9 SHA-256: a3678ae1ea60206719d084f74d4c240ab58029abe2fc7a28c2568ec5eca8a773
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a link to a known malicious redirector, ttraff.me, which is likely used to lead users to a malicious site. The document body also contains a large number of links to various PDF files hosted on Shopify, suggesting a link farm or SEO poisoning attempt to improve search engine ranking for the malicious URL. The ML classifier strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=stellaris+defensive+pact+not+working
    • https://cdn.shopify.com/s/files/1/0427/8353/9366/files/solving_linear_inequality_worksheet.pdf
    • https://cdn.shopify.com/s/files/1/0444/7987/3191/files/general_reading_passages_for_ielts.pdf
    • https://cdn.shopify.com/s/files/1/0428/7735/4143/files/vevibidovidazinerorir.pdf
    • https://cdn.shopify.com/s/files/1/0434/3146/1016/files/5_syllable_words.pdf
    • https://cdn.shopify.com/s/files/1/0428/5304/0295/files/goxoparojajomunob.pdf
    • https://bd5973d2-614f-4a5e-8d71-f1602c300d37.filesusr.com/ugd/d5cf39_d78e682017d44ffaac9f7bec166d7380.pdf?index=true
    • https://9aac3286-7712-4f90-88c6-35b4f31a1374.filesusr.com/ugd/db80c5_d52e4662fd59497ead112e8f695ce440.pdf?index=true
    • https://c386ec93-040a-40d9-9bc8-f38a3fc0aa3b.filesusr.com/ugd/b27199_a790d6c2356b45059e9c8eb9feb3085c.pdf?index=true
    • https://b320eef4-27bd-419f-b5fa-bcbc6b12571f.filesusr.com/ugd/f99735_27db8f5357564bb1a480b2d39f4320ac.pdf?index=true
    • https://cdn.shopify.com/s/files/1/0434/6658/8325/files/zataxoxona.pdf
    • https://cdn.shopify.com/s/files/1/0451/0292/3939/files/analysis_and_design_of_parallel_algorithms_lakshmivarahan.pdf
    • https://cdn.shopify.com/s/files/1/0432/4353/6552/files/36157238075.pdf
    • https://8270c65a-9bdf-4155-b18a-acb58c271e91.filesusr.com/ugd/665c20_7f8b1db6395e42a49351024df1d19b79.pdf?index=true
    • https://e70002f2-c59a-4d15-9a24-ffc6d859274d.filesusr.com/ugd/1c8c1e_2013e59a66b44bbfa74320c627572b2b.pdf?index=true
    • https://c5e3db18-c719-46a5-b4c8-cd78ba16adbe.filesusr.com/ugd/0ebc1f_b23d008ea30e4b0eb2b09160b0328153.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007076.bin
c0dd30771e5102ba9c6eeaf432a809ab650e78a22be35b59eb44f09ebe2af6a4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7076 5644 bytes
font_01_sfnt_off000083d9.bin
608883d290e052542c69ae085fa13201234070b09254fe44fdea61b13f4df287		 pdf-font-stream PDF embedded font (sfnt) at offset 0x83D9 10404 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.