Malicious PDF — malware analysis report

Static analysis result for SHA-256 a4a5471df31f0a3b…

MALICIOUS

PDF

38.7 KB Created: 2020-08-06 13:41:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2a41e3f46d15f6e1075960ec74a607c2 SHA-1: 609fbdb2d966bfaf08f24cc75a33eb55526440d2 SHA-256: a4a5471df31f0a3bb8e799c7a450a7889768d89e13b30c50a2fec406ebcf3741
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document was flagged as malicious by a machine learning classifier and contains a critical PDF_MALICIOUS_REDIRECTOR_LINK heuristic firing. The document body and embedded links indicate a link farm strategy, with the primary malicious URL being https://ttraff.ru/pify?keyword=verbos+para+contenidos+actitudinales+pdf. This suggests the PDF is intended to lure users to malicious content through a series of redirects.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=verbos+para+contenidos+actitudinales+pdf
    • http://files.asliors.com/uploads/1/3/1/4/131437886/nukawisul-tatiximif-kufenor.pdf
    • http://files.davidfullerentertainment.com/uploads/1/3/0/7/130776267/gopiderigelodo.pdf
    • http://files.alexbadas.com/uploads/1/3/0/7/130775677/wudupanixezokas_bagerowafiwog_mowawadisobowe.pdf
    • http://files.ahcw.org/uploads/1/3/2/8/132815318/5068064.pdf
    • http://wudixare.rebeccarankinyoga.com/uploads/1/3/0/7/130776644/51e9b83ac37.pdf
    • https://cdn.shopify.com/s/files/1/0434/1222/6200/files/3580776556.pdf
    • https://cdn.shopify.com/s/files/1/0438/4188/0224/files/nuxetapabivakisejasis.pdf
    • https://cdn.shopify.com/s/files/1/0431/8278/4676/files/siyavula_physical_science_grade_12_download.pdf
    • https://cdn.shopify.com/s/files/1/0432/9439/2485/files/87492030335.pdf
    • https://cdn.shopify.com/s/files/1/0438/4302/7104/files/82068695094.pdf
    • https://cdn.shopify.com/s/files/1/0431/5847/0807/files/jexapegiduzowufapatilep.pdf
    • https://cdn.shopify.com/s/files/1/0430/9336/0791/files/modelo_canvas_libro.pdf
    • https://cdn.shopify.com/s/files/1/0440/7571/2664/files/sirevugapalilipufogimudox.pdf
    • https://cdn.shopify.com/s/files/1/0433/3273/1038/files/21191053099.pdf
    • https://cdn.shopify.com/s/files/1/0431/4506/8699/files/mevixusasu.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/pegumi.pdf
    • https://cdn.shopify.com/s/files/1/0433/8273/5006/files/besovisitoxixamubid.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004bb3.bin
d9bf3f6b41e3d2361bbec9e96a9be2e744cb6ef2121c84465a4f0e983220681b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4BB3 5252 bytes
font_01_sfnt_off00005d8e.bin
4dce65651168509d23c29733f7150cf533a8e6ef747e4a2aebe96b50709536f0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5D8E 2512 bytes
font_02_sfnt_off00006878.bin
1db9d992f169598c4c3bb6bf06bf1b78eae128e304081a9038ed7ec7408a907c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6878 10756 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.