Malicious PDF — malware analysis report

Static analysis result for SHA-256 b291b5bc385b3f32…

MALICIOUS

PDF

52.0 KB Created: 2020-08-19 10:21:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e21d1d5131abad4a773330f0975313c9 SHA-1: ec11f68dff5817270e2eb5114670ff90d1e7dadf SHA-256: b291b5bc385b3f325dbafb8b8d8f787ed8f98335b9e5a343d70f1203c0561add
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a critical heuristic firing for a malicious redirector link, directing users to 'ttraff.cc'. The document body, though heavily obfuscated, contains the same URL and a keyword suggesting a lure for administrative procedures MCQs. The PDF also exhibits a link farm behavior, with numerous links pointing to Shopify domains, likely for SEO manipulation to increase visibility of the malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=administrative+procedures+mcqs+with+answers+pdf
    • http://files.downriverwestkiwanis.net/uploads/1/3/0/7/130776791/ruguturitar.pdf
    • http://tukoson.sctnewsroom.org/uploads/1/3/1/0/131070722/5500368.pdf
    • https://cdn.shopify.com/s/files/1/0450/1933/2766/files/brts_ahmedabad_time_table.pdf
    • https://cdn.shopify.com/s/files/1/0436/4759/8742/files/l_aleph_borges_ita.pdf
    • https://cdn.shopify.com/s/files/1/0431/2370/3969/files/a._s._gupta_calculus_of_variations_with_applications.pdf
    • https://cdn.shopify.com/s/files/1/0433/4636/2523/files/depugijotununezom.pdf
    • https://cdn.shopify.com/s/files/1/0437/4007/0042/files/soccer_fitness_training_program.pdf
    • https://cdn.shopify.com/s/files/1/0434/4492/8674/files/animal_cells_and_tissues.pdf
    • https://cdn.shopify.com/s/files/1/0436/4002/9344/files/tenogikur.pdf
    • https://cdn.shopify.com/s/files/1/0436/3078/8758/files/kijagafavumumuja.pdf
    • https://cdn.shopify.com/s/files/1/0431/2861/9168/files/50691271075.pdf
    • https://cdn.shopify.com/s/files/1/0438/1173/3664/files/19517157720.pdf
    • https://cdn.shopify.com/s/files/1/0437/8125/9421/files/28117133298.pdf
    • https://cdn.shopify.com/s/files/1/0428/0510/0707/files/55513373861.pdf
    • https://cdn.shopify.com/s/files/1/0429/2168/9254/files/80861183796.pdf
    • https://cdn.shopify.com/s/files/1/0430/3503/3757/files/xapawobi.pdf
    • https://cdn.shopify.com/s/files/1/0445/4167/3636/files/music_an_appreciation_10th_edition.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007e58.bin
09837c5e55cfe5b94c1da0d10a4ce15416cbe706b1bee03be19075d1c9b4d74e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7E58 5512 bytes
font_01_sfnt_off000090f6.bin
e13d499098026646044baed016c5ca0bf61de91f76f68cb422cadead4c02f364		 pdf-font-stream PDF embedded font (sfnt) at offset 0x90F6 10356 bytes
font_02_sfnt_off0000b41e.bin
cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB41E 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.