Malicious PDF — malware analysis report

Static analysis result for SHA-256 cb3497363d293d93…

MALICIOUS

PDF

42.8 KB Created: 2020-08-02 11:15:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c076f4268b95412f12e51eb6a0fc6d0b SHA-1: a511455a4edb6acaa7d4afc5bbf27b22e08336b7 SHA-256: cb3497363d293d93068f53f88b12ab98419c10200111b0a0dda23f8339e094b4
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links, many of which point to external resources hosted on Shopify. One critical heuristic firing indicates that the PDF links to known malicious redirector infrastructure, specifically 'https://ttraff.cc/pify?keyword=middle+finger+ascii'. This suggests the document is designed to lure users into clicking malicious links, likely leading to further compromise. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=middle+finger+ascii
    • http://files.shaeshaeshae.com/uploads/1/3/1/0/131069879/8507929.pdf
    • http://files.cindisbeadaliciouscreations.com/uploads/1/3/2/7/132740804/fd4d69c0f7896.pdf
    • http://files.hardtofindprops.com/uploads/1/3/1/4/131453657/rumuzed-doterowi-zulegijapuroj.pdf
    • https://cdn.shopify.com/s/files/1/0433/5131/0488/files/42691963578.pdf
    • https://cdn.shopify.com/s/files/1/0432/8852/7013/files/merasulalulizibekon.pdf
    • https://cdn.shopify.com/s/files/1/0431/6381/2002/files/57085254808.pdf
    • https://cdn.shopify.com/s/files/1/0428/8764/3302/files/80818274107.pdf
    • https://cdn.shopify.com/s/files/1/0433/7047/9766/files/84738554093.pdf
    • https://cdn.shopify.com/s/files/1/0448/6466/7810/files/strong_troll_s_blood_potion.pdf
    • https://cdn.shopify.com/s/files/1/0434/1530/6405/files/8429088567.pdf
    • https://cdn.shopify.com/s/files/1/0431/2891/4087/files/10237585026.pdf
    • https://cdn.shopify.com/s/files/1/0431/2013/2257/files/75562367190.pdf
    • https://cdn.shopify.com/s/files/1/0431/4074/3329/files/fusefixonolezagimogela.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004312.bin
47b72bf2ebb92d55858138525c38f1c548c6b080c0e34004132e2fefb6a10a04		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4312 3272 bytes
font_01_sfnt_off00004ed3.bin
d96e71232bf89c2e61c95b1147b234f89fd7719e92cdff474424542669900e55		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4ED3 5196 bytes
font_02_sfnt_off00006097.bin
252b8b293aaf67f4dd8eb5819fc8d80b985eb7447701c886c34ada6e114db441		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6097 10284 bytes
font_03_sfnt_off00008422.bin
751f3808664c434aac31a65c18b147b17c62044e539db25b7a9f1db76ec89977		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8422 17012 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.