Malicious PDF — malware analysis report

Static analysis result for SHA-256 c8ab1811f0069e81…

MALICIOUS

PDF

218.0 KB Created: 2020-08-07 15:54:17 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2a6f94424c02a5767a5f9509118935dc SHA-1: 51fa1f1418760713a958a94e35299cc9d3952725 SHA-256: c8ab1811f0069e81ebad6ae5bda1f2c7132277f94ac7f45b46e8e029daf039ef
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF contains a heuristic firing for a malicious redirector link pointing to 'https://ttraff.com/pify?keyword=online+advertising+tutorial+pdf'. The document body, though heavily obfuscated, also contains this URL, suggesting the primary intent is to redirect the user to malicious infrastructure. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9975

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=online+advertising+tutorial+pdf
    • http://files.reneeheissart.com/uploads/1/3/1/6/131637316/fudetipa_juzeku_gubemuxoni_vubazulirotiwod.pdf
    • http://files.megasugianto.com/uploads/1/3/1/4/131406544/xezasitugimuwaju.pdf
    • http://files.fulltiltk9training.org/uploads/1/3/0/9/130968984/duxabeve.pdf
    • http://files.stephenvince.com/uploads/1/3/1/4/131437044/6dce71.pdf
    • https://cdn.shopify.com/s/files/1/0431/1321/8210/files/18277667263.pdf
    • https://cdn.shopify.com/s/files/1/0428/4055/5676/files/rekipexuw.pdf
    • https://cdn.shopify.com/s/files/1/0431/0378/1015/files/fosovawok.pdf
    • https://cdn.shopify.com/s/files/1/0432/4415/9143/files/zaseremosu.pdf
    • https://cdn.shopify.com/s/files/1/0431/4506/8699/files/rafuzunakotutemuzigijare.pdf
    • https://cdn.shopify.com/s/files/1/0435/4641/1160/files/jonufavorobevotide.pdf
    • https://cdn.shopify.com/s/files/1/0431/8189/9944/files/chemistry_dictionary_book.pdf
    • https://cdn.shopify.com/s/files/1/0431/6289/4495/files/gonagedumisakiwi.pdf
    • https://cdn.shopify.com/s/files/1/0434/0065/9100/files/juwagarabisimuji.pdf
    • https://cdn.shopify.com/s/files/1/0432/6942/3269/files/pavekuxowamamofanapeg.pdf
    • https://cdn.shopify.com/s/files/1/0434/4443/7144/files/animated_pokemon_sprites.pdf
    • https://cdn.shopify.com/s/files/1/0431/2868/4701/files/doxobixini.pdf
    • https://cdn.shopify.com/s/files/1/0433/8037/5710/files/73814703249.pdf
    • https://cdn.shopify.com/s/files/1/0428/6968/6431/files/katepilodezoxenurivelolaw.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001a7e4.bin
8da562968bc944a14c2895fdd9d11c04b9a3f947eee3448fa3046df5b779bb2d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1A7E4 97084 bytes
font_01_sfnt_off0002c7b7.bin
bed724319960ecee38941a6f1684bb9f5dde7146401ccb8205cb400da5e46afe		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2C7B7 5180 bytes
font_02_sfnt_off0002d966.bin
728a453efc6e176589469afa90f57f179616b1e97b53e9a1fb9444d95e7baeca		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2D966 1740 bytes
font_03_sfnt_off0002e211.bin
dceeb84479580264de6fefbaccbe7b8de448f150cc856183db941f9958f78c32		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2E211 30884 bytes
font_04_sfnt_off0003315b.bin
22364bf0fd089587df1a6dfb5f49a85a86bbe44afed11ff6c1ab00825420588d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3315B 16824 bytes
font_05_sfnt_off0003491d.bin
9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3491D 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.