Malicious PDF — malware analysis report

Static analysis result for SHA-256 a7f52de6f4b5a173…

MALICIOUS

PDF

52.1 KB Created: 2020-08-11 23:48:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ddf99d1abf53173c1e0944f17b8cb22b SHA-1: 4e4bf7b2fdefac2a99898431a5c09de97383c665 SHA-256: a7f52de6f4b5a173c25f19ab1ead768794da8228606a1d60a1b80e43af4161e1
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a high density of external links, many pointing to a redirector service (ttraff.cc) which is flagged as malicious. The document body, though heavily obfuscated, contains the same malicious URL and several benign-looking Shopify URLs, suggesting a link farm designed to obscure the malicious destination. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=anestesia+para+cirugia+ambulatoria+pdf
    • http://files.iluvmemore.com/uploads/1/3/2/3/132302815/ea158.pdf
    • http://files.mylenebaxterconsulting.com/uploads/1/3/2/6/132695806/kozuxebosalawif_weriripida_dumowuf.pdf
    • http://files.mixmasterrod.com/uploads/1/3/0/7/130775851/940149b6009d155.pdf
    • http://files.earlychildhoodchildren.com/uploads/1/3/1/6/131606491/lifoniten_sugejakivadixu.pdf
    • https://cdn.shopify.com/s/files/1/0436/9684/9051/files/monutizosarixuma.pdf
    • https://cdn.shopify.com/s/files/1/0432/3105/1931/files/37785629297.pdf
    • https://cdn.shopify.com/s/files/1/0433/9374/5046/files/86547353931.pdf
    • https://cdn.shopify.com/s/files/1/0434/1045/6730/files/minecraft_fairy_tail_servers.pdf
    • https://cdn.shopify.com/s/files/1/0437/7352/6178/files/77684178158.pdf
    • https://cdn.shopify.com/s/files/1/0431/8094/9658/files/poremofonatazevugojeb.pdf
    • https://cdn.shopify.com/s/files/1/0432/1663/4016/files/bimevodavajip.pdf
    • https://cdn.shopify.com/s/files/1/0430/9411/4465/files/puduvevabisaxefuxopakud.pdf
    • https://cdn.shopify.com/s/files/1/0439/2553/6936/files/ghostscript_to_png.pdf
    • https://cdn.shopify.com/s/files/1/0440/6145/8582/files/54266890267.pdf
    • https://cdn.shopify.com/s/files/1/0428/6201/8716/files/baxokarejezovafizaferuj.pdf
    • https://cdn.shopify.com/s/files/1/0432/0568/9499/files/blood_magic_binding_ritual.pdf
    • https://cdn.shopify.com/s/files/1/0429/2762/0249/files/national_geographic_magazine_july_2020.pdf
    • https://cdn.shopify.com/s/files/1/0432/2089/3851/files/89557762992.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007353.bin
4140378c16273157df9e13ac91d7dc483e79ee5c863b4ad2a7f54fce01e4dffd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7353 5604 bytes
font_01_sfnt_off0000863c.bin
fc9f28ec109b5cc3e8098b70b9730fc73c7ea22a9f8229de97e3ab1f161cf342		 pdf-font-stream PDF embedded font (sfnt) at offset 0x863C 11680 bytes
font_02_sfnt_off0000ac61.bin
cbbccdb6a01e3301f9c1b906f4871dd5ec1222cf3d9139a3e9aeecb693a00d53		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAC61 16112 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.