Malicious PDF — malware analysis report

Static analysis result for SHA-256 a8db34828f865f22…

MALICIOUS

PDF

51.6 KB Created: 2020-08-13 23:30:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c602a171df2628d935a7ea7e3ff821fa SHA-1: eecf7171683947c5c5f806b54ceb50a80b334b15 SHA-256: a8db34828f865f222720b0e8eb3609742acbc81fb97296050fba34f52474913e
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'ttraff.com'. Additionally, it features a large number of embedded external links, many hosted on Shopify, which is characteristic of SEO poisoning or link farm tactics. The ML classifier also strongly indicated maliciousness. While no scripts were extracted, the presence of the malicious redirector strongly suggests an intent to lure the user to a harmful destination.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wb?keyword=tnfusrc%20result%202019%20pdf
    • http://files.deborahlawrenceschafer.com/uploads/1/3/2/6/132681579/b064cda64e8254.pdf
    • http://files.emilybridghamportfolio.com/uploads/1/3/2/6/132681992/8081417.pdf
    • http://files.buttonplanet.com/uploads/1/3/1/6/131606878/biriregagasu_jexibofuxodo_wobesadejolari_miruz.pdf
    • http://files.jenniferrosewebster.com/uploads/1/3/1/8/131856435/f0f544827c05485.pdf
    • https://cdn.shopify.com/s/files/1/0430/0813/1233/files/calendario_juventus_2020_19.pdf
    • https://cdn.shopify.com/s/files/1/0432/3095/3630/files/minecraft_pumpkin_pie_recipe.pdf
    • https://cdn.shopify.com/s/files/1/0434/1478/2104/files/93022767115.pdf
    • https://cdn.shopify.com/s/files/1/0431/9058/3464/files/regenobaxumotinik.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/bofudajix.pdf
    • https://cdn.shopify.com/s/files/1/0432/8541/4056/files/vedujamapetotil.pdf
    • https://cdn.shopify.com/s/files/1/0434/2608/7064/files/41697565352.pdf
    • https://cdn.shopify.com/s/files/1/0435/8579/8301/files/61710783208.pdf
    • https://cdn.shopify.com/s/files/1/0429/5458/8316/files/kadambari_free_download_in_bengali.pdf
    • https://cdn.shopify.com/s/files/1/0433/2588/2518/files/types_of_business_model_generation.pdf
    • https://cdn.shopify.com/s/files/1/0436/1430/6467/files/recent_banking_awareness_questions.pdf
    • https://cdn.shopify.com/s/files/1/0432/9780/0350/files/javirawamedodiw.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007563.bin
4be1809d2b6c606e3bac487e0e292e3b6d05d74ab30e751373164c2e5ca49916		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7563 5368 bytes
font_01_sfnt_off000087b6.bin
11854f68825ff6895842377b742a7016e5aaa15603e22b0ad17ac82902f70be1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x87B6 11228 bytes
font_02_sfnt_off0000ac82.bin
9af6fc3bf9d751f70540aea0fa47faa159a3604992cda23d2adcda3ffc5346b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAC82 16092 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.