Malicious PDF — malware analysis report

Static analysis result for SHA-256 c9e50423f0c504a7…

MALICIOUS

PDF

41.1 KB Created: 2020-08-12 20:24:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a17706313dd39e6680d2488188d64f28 SHA-1: 95d17fa0d812db4a50f0965bc038a450d3b7a9f8 SHA-256: c9e50423f0c504a79f84e0fb12f92c52ab1362318213bca451247a1600df9132
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links, many of which point to a link farm hosted on cdn.shopify.com, and one critical link to a known malicious redirector at ttraff.cc. This indicates a phishing or scam attempt designed to drive traffic to malicious infrastructure. The document body text is obfuscated and contains what appears to be a lure related to an alarm clock manual, likely to disguise the malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wb?keyword=sharp%20projection%20alarm%20clock%20with%20sleep%20sounds%20manual
    • http://files.canntreasures.com/uploads/1/3/0/7/130739117/faturenujiwuxu.pdf
    • http://files.ddmobilemarineservices.com/uploads/1/3/0/8/130813108/kilek.pdf
    • http://files.dogmamoncton.com/uploads/1/3/1/4/131407424/1f544.pdf
    • https://cdn.shopify.com/s/files/1/0437/5497/9477/files/kukorin.pdf
    • https://cdn.shopify.com/s/files/1/0429/1277/6351/files/ripunoxufipedavux.pdf
    • https://cdn.shopify.com/s/files/1/0435/1016/9759/files/73408776316.pdf
    • https://cdn.shopify.com/s/files/1/0430/1019/5605/files/tugawugidumof.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/pobilimej.pdf
    • https://cdn.shopify.com/s/files/1/0433/0648/3876/files/contract_agreement_format.pdf
    • https://cdn.shopify.com/s/files/1/0431/7567/4012/files/reading_comprehension_grade_12.pdf
    • https://cdn.shopify.com/s/files/1/0432/3459/0888/files/badajeg.pdf
    • https://cdn.shopify.com/s/files/1/0431/8897/7813/files/vusujatotujidiro.pdf
    • https://cdn.shopify.com/s/files/1/0434/0904/7708/files/the_wicked_good_ketogenic_diet_cookbook.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006153.bin
376d9b4389fd5fb72e867aa3dfbc4afd58c4a4c7cb8bb3b98471de4b7e384dfb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6153 5648 bytes
font_01_sfnt_off0000746a.bin
35342d2c5d5c00974be88e1dac2e6b1dc953fc2be74ff8c9b3c29701a7e8a9ce		 pdf-font-stream PDF embedded font (sfnt) at offset 0x746A 10156 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.