Malicious PDF — malware analysis report

Static analysis result for SHA-256 d32b5d00aeea39e4…

MALICIOUS

PDF

51.4 KB Created: 2020-08-01 01:00:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a38362ecebd22f12e10238b258fceeb3 SHA-1: 7542a9cea579749253c6c5b8380772b086ca2536 SHA-256: d32b5d00aeea39e442e53088b7d56f2a41bdf81d8c28162ae3df045b25bf3527
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a link farm designed to SEO-abuse, directing users to a malicious redirector. The primary malicious URL identified is ttraff.cc, which is known for redirecting to further malicious content. The document body, though heavily obfuscated, contains the target URL and references to search terms, suggesting a lure to trick users into clicking the link. No scripts were extracted, but the PDF structure and embedded links strongly indicate a phishing or redirection attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=iterative+depth+first+search
    • http://files.globallearning-cuba.com/uploads/1/3/1/4/131438018/kigewaf-linagolaget-fowesubemizol-zifaridep.pdf
    • http://files.devonphotographytraining.com/uploads/1/3/2/6/132681028/7610473.pdf
    • http://files.sharasahenley.com/uploads/1/3/1/4/131438195/68c1f2c5c33b9.pdf
    • http://files.leathaliberty.com/uploads/1/3/0/8/130873918/dodefar-jekev-livugodul-gutixoditaw.pdf
    • https://cdn.shopify.com/s/files/1/0438/8493/7384/files/94802150380.pdf
    • https://cdn.shopify.com/s/files/1/0437/2643/8550/files/81871365899.pdf
    • https://cdn.shopify.com/s/files/1/0432/5012/2916/files/berufitinarewofe.pdf
    • https://cdn.shopify.com/s/files/1/0437/3331/9831/files/kilafubi.pdf
    • https://cdn.shopify.com/s/files/1/0431/8956/7650/files/kugufewajadafelov.pdf
    • https://cdn.shopify.com/s/files/1/0432/2636/6116/files/54601671174.pdf
    • https://cdn.shopify.com/s/files/1/0434/0717/9941/files/hayley_orrantia_instagram.pdf
    • https://cdn.shopify.com/s/files/1/0430/5800/4117/files/75419458964.pdf
    • https://cdn.shopify.com/s/files/1/0431/2678/4157/files/73969329960.pdf
    • https://cdn.shopify.com/s/files/1/0429/8765/1235/files/zibagazonoxen.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/paxotaxazojulilinitulo.pdf
    • https://cdn.shopify.com/s/files/1/0432/1535/6067/files/48109998350.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000075b5.bin
102cd7d0608fc240a924a936bd525252f5f8b0562051fea0174e24455d623887
pdf-font-stream PDF embedded font (sfnt) at offset 0x75B5 5208 bytes
font_01_sfnt_off00008770.bin
e12f325ef2f4dc875728d6e6a8e69c40344323f0b62ac2d3bba5c1f1526ef410
pdf-font-stream PDF embedded font (sfnt) at offset 0x8770 10396 bytes
font_02_sfnt_off0000ab3e.bin
49ad0b4516dd0caa76bf42efd742bbba03303a8c8f58f16fb9a5cf2de2efe4dd
pdf-font-stream PDF embedded font (sfnt) at offset 0xAB3E 16180 bytes