Malicious PDF — malware analysis report

Static analysis result for SHA-256 bcb69415726bb6c4…

MALICIOUS

PDF

123.9 KB Created: 2020-08-08 02:59:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 00b1cf0893f43f0b9afd56c47fbc5493 SHA-1: 033d1279949518cc1dc550f087054ec1a5715e27 SHA-256: bcb69415726bb6c4a94d8b310675dbf65efe9924524ba0f654bb5bd03bf8d026
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a critical heuristic firing for a malicious redirector link, which is further supported by the presence of a large number of external PDF links, indicating a link farm. The document body, though partially corrupted, contains text related to 'Hathway cable tv packages 2020 pdf' and the authoring application 'wkhtmltopdf', suggesting a lure. The primary malicious URL is https://ttraff.cc/pify?keyword=hathway+cable+tv+packages+2020+pdf, which likely leads to further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=hathway+cable+tv+packages+2020+pdf
    • http://files.glambyadora.com/uploads/1/3/1/3/131383657/zowabiwosunisom-lexiruji-jujenuv-kegomozibek.pdf
    • http://zinazid.fitcoresmartmoves.com/uploads/1/3/1/3/131379578/xatisuzego.pdf
    • http://files.unitedbymusic.eu/uploads/1/3/0/7/130775997/vixulinija.pdf
    • http://files.europe3i.com/uploads/1/3/1/1/131164202/6164393.pdf
    • https://cdn.shopify.com/s/files/1/0432/4383/1464/files/ditorasidop.pdf
    • https://cdn.shopify.com/s/files/1/0432/3622/9278/files/90360711823.pdf
    • https://cdn.shopify.com/s/files/1/0437/2194/9335/files/nemumusiwejiritefudi.pdf
    • https://cdn.shopify.com/s/files/1/0437/8034/1917/files/10613490736.pdf
    • https://cdn.shopify.com/s/files/1/0432/8371/0108/files/88888584374.pdf
    • https://cdn.shopify.com/s/files/1/0428/1230/9670/files/33368430652.pdf
    • https://cdn.shopify.com/s/files/1/0429/2483/4975/files/98580470508.pdf
    • https://cdn.shopify.com/s/files/1/0430/8549/6469/files/vabatuvozomowelorasiviku.pdf
    • https://cdn.shopify.com/s/files/1/0437/6484/2647/files/pibefobinetufapif.pdf
    • https://cdn.shopify.com/s/files/1/0436/4324/0606/files/anglo_american_literature_answer_key.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000060c9.bin
731c6de51cbab7025a8ed60143125704792b28b17d54f46522f3052829cd577e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x60C9 103060 bytes
font_01_sfnt_off00018bcc.bin
de889e1f10d4595dad0fc3b907882a2f41cc0e17f18cc8f4a58b2e8b8711359b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x18BCC 6016 bytes
font_02_sfnt_off0001a060.bin
96e1dffcb8485bc5a0e29119ad4f89c9f6c75df95cbc5af689e81e31af2f44d1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1A060 14244 bytes
font_03_sfnt_off0001cd16.bin
f0204b867e92683890a138c20c5967aab97ca427519a77ea1ba04c369de6f671		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1CD16 16144 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.