Malicious PDF — malware analysis report

Static analysis result for SHA-256 cae4219cdc8e041b…

MALICIOUS

PDF

36.9 KB Created: 2020-08-31 01:26:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: cc1aaf26a26319c444206c98fb7db7f9 SHA-1: 2fe6b8d2a3bb437d9dc1d29cc4ea8be102fcf48e SHA-256: cae4219cdc8e041b5c066bf31234e41428eeb243de50b883b858321c6dec573c
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links, many pointing to Shopify domains, but one critical link directs to the ttraff.com redirector infrastructure. This indicates a link farm or SEO poisoning attack designed to funnel users to malicious content. The ML classifier strongly supports the malicious nature of this PDF.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=fingerprinting+in+newark+nj+halsey+s
    • https://static.usrfiles.com/ugd/37321e_a4361f7b04724842884125d2af2e6e74.pdf
    • https://static.usrfiles.com/ugd/b8c837_9d01c966a0c143d886debc6ec7c5fe9d.pdf
    • https://static.usrfiles.com/ugd/b8c837_41dbeb698bd24e83b59ff60dc4f5f003.pdf
    • https://static.usrfiles.com/ugd/253000_6fbcd4b5a5344630be9bb48e0bff51a4.pdf
    • https://cdn.shopify.com/s/files/1/0430/0357/6481/files/oxford_dictionary_of_synonyms_and_antonyms_download.pdf
    • https://cdn.shopify.com/s/files/1/0439/1128/2843/files/pudapenuwaleb.pdf
    • https://cdn.shopify.com/s/files/1/0433/8299/7141/files/avira_vpn_android_apk.pdf
    • https://cdn.shopify.com/s/files/1/0456/9949/8140/files/android_sdk_version_28._0._3.pdf
    • https://cdn.shopify.com/s/files/1/0431/4054/6714/files/tolivuxejapalisisubara.pdf
    • https://cdn.shopify.com/s/files/1/0434/6881/6544/files/vukojokekinumiwitutagu.pdf
    • https://cdn.shopify.com/s/files/1/0431/3615/5809/files/26514986298.pdf
    • https://cdn.shopify.com/s/files/1/0440/1777/8838/files/tekibiralug.pdf
    • https://cdn.shopify.com/s/files/1/0429/4764/1511/files/guzegijubopomotusavo.pdf
    • https://cdn.shopify.com/s/files/1/0438/7504/1435/files/dota_auto_chess_mobile_free.pdf
    • https://cdn.shopify.com/s/files/1/0430/3123/2674/files/cantonese_dictionary.pdf
    • https://cdn.shopify.com/s/files/1/0434/3591/7464/files/42055998756.pdf
    • https://cdn.shopify.com/s/files/1/0448/0778/2557/files/soburuvalega.pdf
    • https://cdn.shopify.com/s/files/1/0438/4079/8885/files/asphalt_8_for_pc_filehippo.pdf
    • https://cdn.shopify.com/s/files/1/0440/3894/6981/files/lumemina.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://cdn.shopify.com/s/files/1/0440/3894/6981/files/lumemina.p

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005092.bin
495d7744647471667e5ef49f044a234bf3ad6532c8ddb12581f0564b243838c5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5092 5368 bytes
font_01_sfnt_off000062ed.bin
a06b7c67123bcb0480368623938ab6e10a6eafdbb4123d0f38aeaf5cf02a0160		 pdf-font-stream PDF embedded font (sfnt) at offset 0x62ED 10368 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.