Malicious PDF — malware analysis report

Static analysis result for SHA-256 ad05229f1acf7cb0…

MALICIOUS

PDF

64.6 KB Created: 2020-08-05 05:55:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 97ccfe5ba844c017f81ea62b748cef96 SHA-1: 107b98a5954180e71c1f321e7254e556dfc43c60 SHA-256: ad05229f1acf7cb06606e8cb5355bb70213d628dcf4856efd651a8b9edf7c44f
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.cc/pify?keyword=callan+method+stage+3+pdf+chomikuj'. Additionally, it exhibits characteristics of a PDF link farm, with numerous embedded URLs, many hosted on Shopify. The ML classifier also strongly flagged this PDF as malicious. No scripts were extracted, and the document body was heavily obfuscated, but the presence of the malicious redirector is the primary indicator of compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=callan+method+stage+3+pdf+chomikuj
    • http://files.proctorlutheran.org/uploads/1/3/0/7/130740563/8efd6945.pdf
    • http://files.northshoreboosterclub.org/uploads/1/3/0/7/130775565/kijijet_latazewakofexi_nujitige.pdf
    • http://files.apexoverlay.com/uploads/1/3/0/8/130873732/gedijexoxas_gotox_dofatetesizur_lizadubejufod.pdf
    • http://files.shopblmboutique.com/uploads/1/3/0/7/130775701/95ee7.pdf
    • https://cdn.shopify.com/s/files/1/0435/4323/2661/files/3367055532.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/kazapuv.pdf
    • https://cdn.shopify.com/s/files/1/0431/5817/5893/files/sezalewadanuregalo.pdf
    • https://cdn.shopify.com/s/files/1/0433/0553/3604/files/65227953542.pdf
    • https://cdn.shopify.com/s/files/1/0431/4329/9234/files/legov.pdf
    • https://cdn.shopify.com/s/files/1/0437/7876/9045/files/57493159347.pdf
    • https://cdn.shopify.com/s/files/1/0432/8361/1801/files/99907774480.pdf
    • https://cdn.shopify.com/s/files/1/0431/0705/7825/files/54489159709.pdf
    • https://cdn.shopify.com/s/files/1/0431/4952/5156/files/77156057376.pdf
    • https://cdn.shopify.com/s/files/1/0444/2944/3238/files/matlab_gaussian_function.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/kulabegidubonigupux.pdf
    • https://cdn.shopify.com/s/files/1/0431/8094/9659/files/visual_basic.pdf
    • https://cdn.shopify.com/s/files/1/0435/4346/2037/files/ball_mill_troubleshooting_pdf.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00009dfe.bin
9f7e212dab2063a124bca64961a238f37cf3a66caafdbc3dc26bfc2de1727e65		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9DFE 5684 bytes
font_01_sfnt_off0000b12f.bin
6d2a3a16cc464ce72cf05976c7f96a31c93af2202e0dc760c37a694345e222ee		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB12F 1800 bytes
font_02_sfnt_off0000b9bf.bin
00fcd7dc776742da3b4f06d164eb32649af0fc85c428606c688d227313939057		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB9BF 10636 bytes
font_03_sfnt_off0000de58.bin
4954ddec54c61b6acc7eddbac306bc890d05f3afdfcf3ae890c7612da0a7d668		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDE58 16376 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.