Malicious PDF — malware analysis report

Static analysis result for SHA-256 bf1ea7252f6640c1…

MALICIOUS

PDF

52.2 KB Created: 2020-08-16 22:55:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b8b6bf9f5b3d9b592e30af6df71b3b65 SHA-1: 7063d3e6f84bdb1816380f5ef2a21cdd5edc948c SHA-256: bf1ea7252f6640c107e4af04de62f8924799a96752146d855a05df64d49adc63
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links, many of which point to a redirector service (ttraff.com) known for malicious activity. The ML classifier also strongly indicated maliciousness. The document body appears to be obfuscated or corrupted, but the presence of the malicious redirector URL is the primary indicator of compromise. The embedded links likely serve as a link farm to distribute traffic and potentially evade detection.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=asagao+to+kase-+san+batch
    • http://files.triokhnopff.com/uploads/1/3/0/9/130969075/4801465.pdf
    • http://zapaze.bloom4wellness.com/uploads/1/3/1/3/131383407/6730112.pdf
    • https://cdn.shopify.com/s/files/1/0428/4160/4263/files/sobisalezewiromarapenosar.pdf
    • https://cdn.shopify.com/s/files/1/0435/8176/7848/files/wimobinejeb.pdf
    • https://cdn.shopify.com/s/files/1/0434/2087/6962/files/lerotevanimirosake.pdf
    • https://cdn.shopify.com/s/files/1/0432/3993/2064/files/1440149304.pdf
    • https://cdn.shopify.com/s/files/1/0438/2218/6656/files/residential_building_plans_with_dimensions.pdf
    • https://cdn.shopify.com/s/files/1/0429/6078/1465/files/atlantis_big_fish_games_free.pdf
    • https://cdn.shopify.com/s/files/1/0439/9045/0334/files/28888211226.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/jepomosojavadoji.pdf
    • https://cdn.shopify.com/s/files/1/0430/0849/1673/files/boating_exam_questions_and_answers.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/tovetutokukike.pdf
    • https://cdn.shopify.com/s/files/1/0430/3768/7962/files/sudaj.pdf
    • https://cdn.shopify.com/s/files/1/0436/1319/2349/files/66904332322.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005e59.bin
bbece7c5f22fd6ecb02a2909221e76491176137073db1ff2445a894c3a769dc5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5E59 7436 bytes
font_01_sfnt_off000077b7.bin
dfb0f093a44d0c7ef351bb774b013a8a316ad63d1111e864ee774aeee46eb60f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x77B7 4896 bytes
font_02_sfnt_off0000885a.bin
aea6fe06b258ebbeba819707d3fd9f5faa298c652ee261d89cc08f495e052326		 pdf-font-stream PDF embedded font (sfnt) at offset 0x885A 14652 bytes
font_03_sfnt_off0000b587.bin
cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB587 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.