Malicious PDF — malware analysis report

Static analysis result for SHA-256 c2b668a58b9caad3…

MALICIOUS

PDF

35.8 KB Created: 2020-08-04 02:11:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b0c689f81c69f4fdfea69178d387d391 SHA-1: 66dbb8839653b29816783ca5cf0fffdbb36de85f SHA-256: c2b668a58b9caad393675f66619028eb725a08ce35e7b559297c83a942e4f2c5
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.com/pify?keyword=astm+b117+18+pdf+free+download'. Additionally, it features a link farm heuristic, indicating a large number of external links, many of which are hosted on Shopify. The document body, though partially corrupted, contains the lure text 'Astm b117 18 pdf free download' and the malicious redirector URL, reinforcing the social engineering attempt to trick users into downloading further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=astm+b117+18+pdf+free+download
    • http://files.thekirkoscaravan.com/uploads/1/3/2/6/132682204/safedekeriwuret.pdf
    • http://files.metalmeltdown.com/uploads/1/3/0/7/130775755/36f932b68a.pdf
    • http://files.bornagainhealth.com/uploads/1/3/0/8/130813834/bufowuwipel.pdf
    • http://files.mindfuledibles.me/uploads/1/3/0/7/130775786/xofagupix_zifovun_pizujolad.pdf
    • https://cdn.shopify.com/s/files/1/0434/4473/2065/files/wedozi.pdf
    • https://cdn.shopify.com/s/files/1/0429/9508/9559/files/minecraft_1._14._4_patch_notes.pdf
    • https://cdn.shopify.com/s/files/1/0430/7727/1713/files/honda_accord_2013_manual.pdf
    • https://cdn.shopify.com/s/files/1/0429/5272/0543/files/zogon.pdf
    • https://cdn.shopify.com/s/files/1/0431/5283/4717/files/kakibuziwimojapukuvek.pdf
    • https://cdn.shopify.com/s/files/1/0433/9456/4250/files/91631974536.pdf
    • https://cdn.shopify.com/s/files/1/0434/1497/8718/files/lomofi.pdf
    • https://cdn.shopify.com/s/files/1/0429/5317/9289/files/48994416787.pdf
    • https://cdn.shopify.com/s/files/1/0439/0925/1227/files/60135639810.pdf
    • https://cdn.shopify.com/s/files/1/0437/5435/6897/files/47185004426.pdf
    • https://cdn.shopify.com/s/files/1/0447/3847/8229/files/remedies_for_breach_of_contract_with_examples.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004cad.bin
ded41109cbffb05e216361346d755d43aa22ce1fad00d997f9dcd9734583bbbb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4CAD 5732 bytes
font_01_sfnt_off00006039.bin
88899b798e8b6261dd184be1ffd1700dd8ad0df2a1bd252ae49f4655db4f31f0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6039 10104 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.