Malicious PDF — malware analysis report

Static analysis result for SHA-256 a5378bda1574ae75…

MALICIOUS

PDF

70.2 KB Created: 2020-07-22 19:57:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c0ba2fc8d68e54fe4d60bec314703b7e SHA-1: d8530b20cf115693b213abd996fbd57a32c8c020 SHA-256: a5378bda1574ae756c406bf787eca2a8ad11b82843f9abf53fdd10deee8c6984
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains numerous embedded links, with a critical heuristic identifying a malicious redirector at 'ttraff.com'. Another heuristic indicates a link farm designed to appear as academic content, likely to lure victims. The ML classifier strongly supports the malicious nature of this PDF. No scripts were extracted, but the primary attack vector is the malicious redirection embedded within the document.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=computational+mathematics+in+engineering+and+applied+science+pdf
    • http://files.antiochwaukegan.org/uploads/1/3/1/4/131454766/ff0b9c641a08d.pdf
    • http://files.schaefernursery.com/uploads/1/3/0/7/130775729/173f9ee88ae97a2.pdf
    • http://files.debbiesangelsproductions.com/uploads/1/3/1/3/131382243/tixiz_matidigo.pdf
    • http://files.mydaybydaydiary.com/uploads/1/3/0/8/130814467/2975827.pdf
    • https://cdn.shopify.com/s/files/1/0435/0813/8150/files/mijizirifa.pdf
    • https://cdn.shopify.com/s/files/1/0427/4647/8758/files/gubuw.pdf
    • https://cdn.shopify.com/s/files/1/0433/0638/5573/files/ginepisobil.pdf
    • https://kawumafovod.files.wordpress.com/2020/07/dotesitenofuwepuzowavugew.pdf
    • https://mojilil.files.wordpress.com/2020/07/32535667404.pdf
    • https://relininomovu.files.wordpress.com/2020/07/93300410381.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/mapitawaluzosamorexub.pdf
    • https://cdn.shopify.com/s/files/1/0429/1778/9862/files/29853698848.pdf
    • https://cdn.shopify.com/s/files/1/0428/5041/8847/files/gatujebimul.pdf
    • https://cdn.shopify.com/s/files/1/0431/5892/9570/files/zikajaxewumukugozusos.pdf
    • https://cdn.shopify.com/s/files/1/0431/6656/4507/files/puvim.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/xasaxikopakepiditewevumub.pdf
    • https://cdn.shopify.com/s/files/1/0427/7311/9143/files/78729112284.pdf
    • https://cdn.shopify.com/s/files/1/0431/7829/5450/files/magesixon.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/81256704061.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/sakumuxapiwitisozu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000bf43.bin
753abb989cfaa5896fc58ca36de0b9f9d4996ccd3c1b759a03ce05a907788fef
pdf-font-stream PDF embedded font (sfnt) at offset 0xBF43 5476 bytes
font_01_sfnt_off0000d1a7.bin
c29a1e4636379ca28c4134f319be258536855c2f97b949e2ef692327f61c1e3f
pdf-font-stream PDF embedded font (sfnt) at offset 0xD1A7 10276 bytes
font_02_sfnt_off0000f4c4.bin
23e5e0a6ad5360bf10628433507e5aab34c42d7d900ccb2a5214949f2168b422
pdf-font-stream PDF embedded font (sfnt) at offset 0xF4C4 16112 bytes