Malicious PDF — malware analysis report

Static analysis result for SHA-256 d2cadb8d957cfd0f…

MALICIOUS

PDF

46.8 KB Created: 2020-09-20 07:06:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a684afac8986b057f3fc226ccecd4275 SHA-1: c2ab78f7127c8a6feff183af2cab2323dc1bd653 SHA-256: d2cadb8d957cfd0fe21a9f0cb4546ffec11ab19f39cdca4cfbebc3b13efb0922
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.me/wix?keyword=ohio+state+schedule+2020+basketball'. Additionally, it exhibits characteristics of a PDF link farm, with numerous embedded links to external PDFs, many hosted on cdn.shopify.com. The document body, though partially corrupted, contains text related to 'Ohio state schedule 2020 basketball' and the malicious URL, suggesting a lure to disguise the malicious intent. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=ohio+state+schedule+2020+basketball
    • https://f438965b-c903-4883-b014-a1703ca6b
    • https://cdn.shopify.com/s/files/1/0433/6294/3144/files/zuzoxamisudesolujajidej.pdf
    • https://cdn.shopify.com/s/files/1/0437/2001/6021/files/61138476908.pdf
    • https://cdn.shopify.com/s/files/1/0437/1379/0106/files/validity_and_reliability_in_research_methods.pdf
    • https://cdn.shopify.com/s/files/1/0432/5657/8212/files/albert_einstein_biography_in_english.pdf
    • https://aa12d29c-e39d-41db-bf4a-d1587adfad09.filesusr.com/ugd/c4ccc4_b2a0a3bcbace4180b45e2bbd56764afe.pdf?index=true
    • https://6b22c583-a760-47a9-8bf6-3a06882fb0fd.filesusr.com/ugd/1cc777_9caf12d0364b4a329484b926f0ba7bb6.pdf?index=true
    • https://940c6bbc-c73d-4fe3-888e-8b9f0a7bf6cc.filesusr.com/ugd/08fe48_3260c26f55f349efbee7d732abf31273.pdf?index=true
    • https://2ac3b331-5034-4802-953e-5ffd9404b34e.filesusr.com/ugd/345929_fd28b8d96b494d9589d651a4444beb45.pdf?index=true
    • https://98e0c42f-eab7-48c7-ae6a-19a141bb4593.filesusr.com/ugd/8bc2a6_9975fc907d534f51b9ae002b5350d6f5.pdf?index=true
    • https://cdn.shopify.com/s/files/1/0434/6842/3334/files/91317536732.pdf
    • https://cdn.shopify.com/s/files/1/0434/5112/1820/files/69850766687.pdf
    • https://cdn.shopify.com/s/files/1/0428/4946/8582/files/dinusatari.pdf
    • https://cdn.shopify.com/s/files/1/0465/2485/8526/files/75063350012.pdf
    • https://3f7d08ea-9429-4ad9-bd91-1b1d3e0104a6.filesusr.com/ugd/87a178_9a254070fe94454b91df32aa3e9d4ffc.pdf?index=true
    • https://734b67c6-0d8e-4e23-9d03-676f345a646c.filesusr.com/ugd/564d2e_3a423803eb2442878547693641057fad.pdf?index=true
    • https://e687cb3e-9339-4ae1-9ec8-c9b9949eaad3.filesusr.com/ugd/95089d_988c81a5332743cbaeb8a96c40ff9f5a.pdf?index=true
    • https://f438965b-c903-4883-b014-a1703ca6bb97.filesusr.com/ugd/1f5cef_4e587b4319ae4b93a9c4d06d8827ce92.pdf?index=true
    • https://81806309-d490-4d38-b88c-891c7510b556.filesusr.com/ugd/8b9728_908411798cc74ce490e1be689bc867af.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007905.bin
8083e1a640749c6ac8d3a24015822c66e43997cbcc0290dd7e11b2319f2ebc51		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7905 5436 bytes
font_01_sfnt_off00008b75.bin
cdd3849bd7a08f74b96422266fd16b5bd4417e74fd593019ed1e3dcc9b2152d3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8B75 10176 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.