Malicious PDF — malware analysis report

Static analysis result for SHA-256 c63174dd5e9bdf97…

MALICIOUS

PDF

57.5 KB Created: 2020-09-16 02:34:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a569b86fb98a9cb2dacc29db47993157 SHA-1: 88bb5915dc97349429ce76a3a0e9b378256c106d SHA-256: c63174dd5e9bdf9785198e645aa29837998143f44abe15e7bc1ce3507c8d8911
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a link to a known malicious redirector, ttraff.com, which is designed to obscure the final destination. The document body, though heavily obfuscated, contains text related to a 'Tumi leather briefcase strap' and the URL itself, suggesting a lure to entice users to click the malicious link. The presence of a large number of external PDF links also indicates a link farm, a common tactic for SEO poisoning or distributing malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=tumi+leather+briefcase+strap
    • https://cdn.shopify.com/s/files/1/0440/3141/0326/files/truman_capote_in_cold_blood_book.pdf
    • https://cdn.shopify.com/s/files/1/0433/3328/8088/files/du_battery_saver_pro_root_apk.pdf
    • https://cdn.shopify.com/s/files/1/0435/3504/0664/files/75828825592.pdf
    • https://static.usrfiles.com/ugd/7dd30d_018460fb734a4b59bd0e7d3c205ad834.pdf
    • https://static.usrfiles.com/ugd/754d94_5e51a48615e84f2bb72d070b73a68642.pdf
    • https://static.usrfiles.com/ugd/98e2de_8e44cd4458674a9ca6fdec6730ad6df4.pdf
    • https://static.usrfiles.com/ugd/afe78f_144c965f9c8240bf82de9d0e2ae39ee3.pdf
    • https://static.usrfiles.com/ugd/a467d2_632ea5a8e24b461192b9977c483e027e.pdf
    • https://cdn.shopify.com/s/files/1/0440/5267/6773/files/best_fish_for_aquaponics_fish_tank.pdf
    • https://cdn.shopify.com/s/files/1/0431/5719/2853/files/jejegog.pdf
    • https://cdn.shopify.com/s/files/1/0484/5341/9173/files/63755839273.pdf
    • https://cdn.shopify.com/s/files/1/0428/8443/2031/files/21101118444.pdf
    • https://cdn.shopify.com/s/files/1/0430/0016/8597/files/suvijoxatanenuba.pdf
    • https://cdn.shopify.com/s/files/1/0431/0922/0501/files/kafimojodogosuzumokuji.pdf
    • https://cdn.shopify.com/s/files/1/0439/4532/8808/files/disability_awareness_merit_badge_pamphlet.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://cdn.shopify.com/s/files/1/0440/5267/6773/files/best_f

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000a45f.bin
224b5255390f738775bf3c46c2bd8b6f184053b7da98903919f395fc4f0b8eaa		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA45F 5344 bytes
font_01_sfnt_off0000b65d.bin
9d4e0f3d28a9fb5c42894e69500ff7772108ef8df31a537113736843394e82c9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB65D 10144 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.