Malicious PDF — malware analysis report

Static analysis result for SHA-256 d5d75d83869b0e83…

MALICIOUS

PDF

41.4 KB Created: 2020-08-17 03:59:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bec166a18796784980ec083c5ec0366f SHA-1: a7031f145d8f2b8915b338ca2b7d034a546a640c SHA-256: d5d75d83869b0e83c5b1608c4e5656067f311c9062225e71557a5033266b6ea5
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file exhibits characteristics of a link farm, with numerous embedded URLs. One URL, 'https://ttraff.ru/pify?keyword=fried+ice+cream+sheet+cake', is flagged as a malicious redirector. The ML classifier also strongly indicated maliciousness. The presence of many links suggests an attempt to lure users to potentially harmful sites, possibly for phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=fried+ice+cream+sheet+cake
    • http://files.genuineplusco.com/uploads/1/3/1/4/131437276/womatik_bupax.pdf
    • http://files.revivalmission.org/uploads/1/3/0/7/130739379/bomesasunoxefov.pdf
    • https://cdn.shopify.com/s/files/1/0430/7157/0069/files/pompe_caprari_mec_a.pdf
    • https://cdn.shopify.com/s/files/1/0432/6660/5219/files/18064906026.pdf
    • https://cdn.shopify.com/s/files/1/0446/1376/3235/files/anti_inflammatory_herbs.pdf
    • https://cdn.shopify.com/s/files/1/0437/7677/0205/files/eagle_time_nt-_3200_bundy_clock_manual.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/denikiv.pdf
    • https://cdn.shopify.com/s/files/1/0438/3762/0381/files/10683669831.pdf
    • https://cdn.shopify.com/s/files/1/0433/4374/1083/files/bangladesh_map_64_districts.pdf
    • https://cdn.shopify.com/s/files/1/0429/6251/8182/files/lipuxiloxuwedajisudetuxox.pdf
    • https://cdn.shopify.com/s/files/1/0435/9605/4690/files/realtor_home_buyer_guide.pdf
    • https://cdn.shopify.com/s/files/1/0433/6982/4407/files/radipidedekobewutif.pdf
    • https://cdn.shopify.com/s/files/1/0431/0020/9309/files/93812050897.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000064e9.bin
1a68c0511d1d8f762fa0d963ab7b5cab20fd89b92337473d6d5e6b1f5f2e2892		 pdf-font-stream PDF embedded font (sfnt) at offset 0x64E9 5168 bytes
font_01_sfnt_off0000764f.bin
09fe933a83618c52cb3c79d298464bbcc3e4978d754a74c7ce62f4742a8d6b45		 pdf-font-stream PDF embedded font (sfnt) at offset 0x764F 10176 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.