Malicious PDF — malware analysis report

Static analysis result for SHA-256 c287798a1808734d…

MALICIOUS

PDF

44.5 KB Created: 2020-09-01 11:12:24 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bc2d34bf4e5c55790b8e06dd4025fd89 SHA-1: 8c38dfdeae8f6068c0c0e64ef0ccf9d60b219a26 SHA-256: c287798a1808734d398047648cb6a846c249ae1f3145a0915cc88737c78ed3c9
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 User Execution: Malicious File T1059.001 PowerShell

The PDF file contains a critical heuristic firing for a malicious redirector link pointing to 'https://ttraff.ru/wix?keyword=folic+acid+davis+drug+guide'. Additionally, it exhibits characteristics of a PDF SEO link farm, with numerous links to other PDFs hosted on Shopify. The document body, though heavily obfuscated, contains text related to 'Folic acid davis drug guide', suggesting a lure to disguise the malicious intent. The primary attack pattern involves redirecting users to a malicious site under the guise of providing information.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=folic+acid+davis+drug+guide
    • https://cdn.shopify.com/s/files/1/0430/9942/2871/files/eia_schedule_923.pdf
    • https://cdn.shopify.com/s/files/1/0432/8488/9758/files/learn_english_filetype.pdf
    • https://cdn.shopify.com/s/files/1/0434/8795/3053/files/nuxesetuxewewajofase.pdf
    • https://cdn.shopify.com/s/files/1/0435/6826/7423/files/duxotexenebikebugobazuno.pdf
    • https://cdn.shopify.com/s/files/1/0434/3608/1308/files/mabilupekum.pdf
    • https://static.usrfiles.com/ugd/cafc24_bafa7bd78ab7401fa30f5ca92865253e.pdf
    • https://cdn.shopify.com/s/files/1/0435/6213/9816/files/guide_to_effective_literacy_instruction_writing.pdf
    • https://cdn.shopify.com/s/files/1/0434/4987/6641/files/puduxelomix.pdf
    • https://cdn.shopify.com/s/files/1/0434/1009/6284/files/logo_design_love_free_download.pdf
    • https://cdn.shopify.com/s/files/1/0437/7457/4749/files/48506817272.pdf
    • https://cdn.shopify.com/s/files/1/0437/8948/4190/files/beat_it_michael_jackson_video_song.pdf
    • https://cdn.shopify.com/s/files/1/0434/4617/3852/files/free_full_page_ad_template.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007012.bin
bff1c502973add181bac4da51e85d9dae4b6907584c62626aa225a454aa9d486		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7012 5124 bytes
font_01_sfnt_off00008198.bin
b4dd5c0b796c733f774d23f3b20b0e0d24a7e9a5f4f76fd7aec67d7e3631706f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8198 10420 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.