Malicious PDF — malware analysis report

Static analysis result for SHA-256 c52b4d480ab5de1a…

MALICIOUS

PDF

52.2 KB Created: 2020-08-12 02:09:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: cc01141c45be2e4bb8fa743fdf04a98d SHA-1: 2148a7ffbc3b2584481809abe3ff24e754219d0b SHA-256: c52b4d480ab5de1a997d85c9470895aac6dd686a47ba07dcbf6214e69eea9092
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a mass of external links, including one pointing to a known malicious redirector at 'ttraff.cc'. The document body, though heavily obfuscated, contains text that appears to be a lure related to 'Análise de dados com python e pandas pdf'. This suggests the PDF is designed to trick users into clicking malicious links, likely leading to further malware or phishing attempts. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=an%25C3%25A1lise+de+dados+com+python+e+pandas+pdf
    • http://fifedo.quinkydinkdonuts.com/uploads/1/3/1/0/131070450/xixuxulukumoj_fobosejuwafipu.pdf
    • http://wumagikuk.littlesunshinedaycaremn.com/uploads/1/3/0/9/130969754/4ba476.pdf
    • http://vizokekud.smalleyestate.myhackney.org/uploads/1/3/0/7/130775643/6d8c29fb860c.pdf
    • https://cdn.shopify.com/s/files/1/0429/4865/7318/files/rilixuwu.pdf
    • https://cdn.shopify.com/s/files/1/0445/2545/3471/files/agricola_board_game_rules.pdf
    • https://cdn.shopify.com/s/files/1/0440/1951/5557/files/53030063287.pdf
    • https://cdn.shopify.com/s/files/1/0429/6835/0873/files/sedefiwow.pdf
    • https://cdn.shopify.com/s/files/1/0427/5381/8790/files/anomalias_del_cordon_umbilical.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/8128296882.pdf
    • https://cdn.shopify.com/s/files/1/0431/1724/8672/files/99470700967.pdf
    • https://cdn.shopify.com/s/files/1/0434/0305/1171/files/gidiwugirelerukotijil.pdf
    • https://cdn.shopify.com/s/files/1/0428/6126/5062/files/75739031671.pdf
    • https://cdn.shopify.com/s/files/1/0430/7347/0618/files/finavidenuzomigewepide.pdf
    • https://cdn.shopify.com/s/files/1/0430/3601/6802/files/73313383484.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000073a0.bin
4e5d530cef4b6f4cb33eb708b630b945fd413426a74c2cab46e1a0f7bac03371		 pdf-font-stream PDF embedded font (sfnt) at offset 0x73A0 5412 bytes
font_01_sfnt_off00008553.bin
daad3f347a4f42f432ee9983e619a7c063e36761dba5934b469418034847e28e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8553 1800 bytes
font_02_sfnt_off00008de1.bin
4485ff9d1deef1fa1d49f57e2023ae8ab0329ba8f2a79f7c6e465e44bf4cda57		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8DE1 12136 bytes
font_03_sfnt_off0000b29d.bin
1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB29D 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.