Malicious PDF — malware analysis report

Static analysis result for SHA-256 bae732908aae620c…

MALICIOUS

PDF

55.5 KB Created: 2020-08-20 13:54:26 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d597b7494189f4ffb25ec0cc6d34bab1 SHA-1: f2d372cdee17d650d6c95d8f84356c1fe1d64cf7 SHA-256: bae732908aae620cfc9620e8655e84659b3697d592909d8b3c22ea57182a8c57
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged as malicious due to a high number of embedded links, many pointing to a link farm hosted on Shopify. One critical heuristic identified a link to a known malicious redirector infrastructure at 'ttraff.com'. The document body, though heavily obfuscated, contains the same redirector URL, suggesting the primary intent is to lure users to malicious sites. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=cuneiform+alphabet+copy+paste
    • http://files.zoningatl.com/uploads/1/3/2/7/132712268/128c84f13b8.pdf
    • http://files.halweinberg.ca/uploads/1/3/0/7/130775370/6435946.pdf
    • http://files.msdiglobal.com/uploads/1/3/2/7/132740747/piwunudas.pdf
    • https://cdn.shopify.com/s/files/1/0435/6879/1713/files/vugumusolipixiluwa.pdf
    • https://cdn.shopify.com/s/files/1/0436/4995/8046/files/nimidewexexi.pdf
    • https://cdn.shopify.com/s/files/1/0431/4995/1138/files/36516808364.pdf
    • https://cdn.shopify.com/s/files/1/0431/6053/5196/files/apex_programming_language_salesforce.pdf
    • https://cdn.shopify.com/s/files/1/0435/9005/8152/files/53597219247.pdf
    • https://cdn.shopify.com/s/files/1/0431/5358/8390/files/notutinitopize.pdf
    • https://cdn.shopify.com/s/files/1/0431/6354/9847/files/92801467157.pdf
    • https://cdn.shopify.com/s/files/1/0431/3910/4917/files/fjeld_og_fritid_nrreport_bningstider.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004f0b.bin
4089529f6e35161327527ba6f3d522b556bb0b2438f4aec1848816456708f124		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4F0B 3496 bytes
font_01_sfnt_off00005acb.bin
b2cfba4b8812875faa01cb5b300f2a12f958329f35373fc3239e580c2159c3de		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5ACB 5404 bytes
font_02_sfnt_off00006cff.bin
8b4954ecd1a55f4cd59bc6c005c11b07e1b3f37fc8e6fe42565c149b8618d7e5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6CFF 17376 bytes
font_03_sfnt_off0000a4e1.bin
098c360b9502c4ff7351c7a5865d163f5235e020838380da4b3950bfd3d51a6d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA4E1 17996 bytes
font_04_sfnt_off0000c14b.bin
565aee6d6a33be383d4256134f2f74cb8f20ecef80307668cfe5b7791413fe64		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC14B 6104 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.