Malicious PDF — malware analysis report

Static analysis result for SHA-256 bacc94c357817fb0…

MALICIOUS

PDF

53.5 KB Created: 2020-08-26 19:21:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b42fb630ac5a30e8ab6c14c8b86fbe9c SHA-1: 7c2c1b906d70fd54279ed8f2dd0d2ab8ed91826d SHA-256: bacc94c357817fb0b821ec1452c09f224797f453bdc678f57b607321c58f9f9f
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.ru/pify?keyword=battlestar+galactica+pilot+watch+online+free'. The document body, though heavily obfuscated, also contains this URL, suggesting the primary intent is to redirect the user to malicious infrastructure. The presence of a large number of embedded links, many pointing to Shopify domains, further supports the link farm heuristic, indicating an attempt to manipulate search engine results or distribute malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=battlestar+galactica+pilot+watch+online+free
    • http://bisuxevun.klamathfallsfootandankle.com/uploads/1/3/1/3/131380160/9224815.pdf
    • http://files.lightoftheworldcoaching.com/uploads/1/3/1/8/131857193/6033629.pdf
    • http://files.affordablecreditsolutions.net/uploads/1/3/1/3/131383838/a9380167e39f.pdf
    • http://files.pixelinedesign.com/uploads/1/3/1/6/131636954/7521903.pdf
    • https://cdn.shopify.com/s/files/1/0431/9939/8052/files/katipavubo.pdf
    • https://cdn.shopify.com/s/files/1/0437/4318/2999/files/atkins_quimica_inorganica_espaol.pdf
    • https://cdn.shopify.com/s/files/1/0430/9336/0801/files/arabic_to_english_word_meaning.pdf
    • https://cdn.shopify.com/s/files/1/0431/5614/4282/files/barriers_of_effective_communication_and_how_to_overcome_them.pdf
    • https://cdn.shopify.com/s/files/1/0438/0826/0258/files/post_tensioning_manual_6th_edition.pdf
    • https://cdn.shopify.com/s/files/1/0433/6631/8230/files/mapaduvokafemebebojipiti.pdf
    • https://cdn.shopify.com/s/files/1/0433/7935/9900/files/because_so_worksheet.pdf
    • https://cdn.shopify.com/s/files/1/0431/6089/5650/files/97918279003.pdf
    • https://cdn.shopify.com/s/files/1/0434/6599/8501/files/17641291184.pdf
    • https://cdn.shopify.com/s/files/1/0431/4392/1820/files/retirement_flyers_templates.pdf
    • https://cdn.shopify.com/s/files/1/0439/3975/8235/files/50167116384.pdf
    • https://cdn.shopify.com/s/files/1/0434/7589/4437/files/belt_and_road_initiative_comic.pdf
    • https://cdn.shopify.com/s/files/1/0438/8985/2568/files/treatment_of_breast_cancer.pdf
    • https://cdn.shopify.com/s/files/1/0431/4637/9426/files/mavipawekobesosuno.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006d94.bin
4dedb81fc825b84eb8f91f22e3e2a4ea7b367c216c2c384823db7e0fb3657ea3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6D94 5420 bytes
font_01_sfnt_off0000800e.bin
2839aa175c1761c3794107a0897c92f94548f3e85fbdfa8897379cd64a514add		 pdf-font-stream PDF embedded font (sfnt) at offset 0x800E 14052 bytes
font_02_sfnt_off0000acca.bin
77371991d0433356685cf1813acffc4653c422d68747999ec7c408e0de0dae4e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xACCA 17996 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.