Malicious PDF — malware analysis report

Static analysis result for SHA-256 b7860d216082666f…

MALICIOUS

PDF

56.8 KB Created: 2020-09-09 20:10:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9ad153ec3e47b7ba2ffc37fd3df11aaf SHA-1: ee686d90824401ce9062f3a6f36dfefcf26365eb SHA-256: b7860d216082666ff02b69c41bea0939855e63310ace9e8e8ddc4ad3927f3766
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a malicious redirector link pointing to 'ttraff.me', which is designed to lure users into downloading potentially malicious content, in this case, a fake 'talking angela game apk'. The document also functions as a link farm, directing users to numerous other PDF files hosted on various domains, some of which are associated with known malicious redirector infrastructure. The ML classifier strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/pify?keyword=talking+angela+game+apk
    • http://numoz.sibclassicspanelandpaint.com/uploads/1/3/0/9/130969280/soliwisudovobivus.pdf
    • http://konapepof.musedigitalmarketing.com/uploads/1/3/1/3/131381046/5992961.pdf
    • http://files.labelleboutiquenyc.com/uploads/1/3/1/1/131164002/saxegelirelozowozej.pdf
    • https://cdn.shopify.com/s/files/1/0433/9580/9431/files/69038097980.pdf
    • https://static.usrfiles.com/ugd/f91cf1_7e7e4817d904438bba8415e0d4268b11.pdf
    • https://static.usrfiles.com/ugd/67e251_7c4b0418c0ff46489275e2618c5af427.pdf
    • https://static.usrfiles.com/ugd/b8c837_eab64c9ed9e54033973e97e9cf7650f1.pdf
    • https://static.usrfiles.com/ugd/455f95_a8713afbdc574a05a6d8a1d68607cc9e.pdf
    • https://cdn.shopify.com/s/files/1/0433/0225/6795/files/vafajanimiluko.pdf
    • https://cdn.shopify.com/s/files/1/0432/7941/7504/files/sowadap.pdf
    • https://cdn.shopify.com/s/files/1/0431/8828/9694/files/jabisiz.pdf
    • https://cdn.shopify.com/s/files/1/0439/8910/6846/files/72270558012.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006077.bin
e131a3da86d43c5d0c83b01d2e286706af41a6b60a7f5ed597608d6414e70242
pdf-font-stream PDF embedded font (sfnt) at offset 0x6077 4072 bytes
font_01_sfnt_off00006efb.bin
a0e3b0ddaea5347e32c49cc80a0b82fa98dd8b2d06007d69790a127975b068db
pdf-font-stream PDF embedded font (sfnt) at offset 0x6EFB 4880 bytes
font_02_sfnt_off00007f81.bin
ca5f87db1984b0fb99546f886ffb6159e566f8a11f159069780a4555bd3e4d5d
pdf-font-stream PDF embedded font (sfnt) at offset 0x7F81 5224 bytes
font_03_sfnt_off00008d63.bin
02d21bf04ca3655a2efaac0eb9a885b6fdebd8b63d03ee8e915e898729e668c6
pdf-font-stream PDF embedded font (sfnt) at offset 0x8D63 10684 bytes
font_04_sfnt_off0000b1e2.bin
cc363a6e66fe5856d7913b197b71d4feaf7ba6165cf71d202c9cd6da52b6e985
pdf-font-stream PDF embedded font (sfnt) at offset 0xB1E2 19476 bytes
font_05_sfnt_off0000cd91.bin
551918360585b1590efa6fd2a215345b2f702067d151a0e4b48cfa7490b57960
pdf-font-stream PDF embedded font (sfnt) at offset 0xCD91 1736 bytes