Malicious PDF — malware analysis report

Static analysis result for SHA-256 d74567e358f9713b…

MALICIOUS

PDF

45.1 KB Created: 2020-08-31 01:18:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c0161dcd70d825c3799e8d9053a8d9a1 SHA-1: 3ecc7ae2d412ef65b786b8fbbd812b72482f4cba SHA-256: d74567e358f9713ba2561f897874b2f2e1d375d60bdc499b0d0441156d04ce03
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a malicious redirector link pointing to 'ttraff.ru', which is designed to lead users to a link farm of 30 other PDF files hosted on Shopify. The document body, though heavily obfuscated, contains text related to 'Angielski w tBumaczeniach' and the URL 'https://ttraff.ru/wix?keyword=angielski+w+t%25C5%2582umaczeniach.+sytuacje', suggesting a lure. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=angielski+w+t%25C5%2582umaczeniach.+sytuacje
    • https://cdn.shopify.com/s/files/1/0438/3742/3776/files/jonujizuxowufaborebe.pdf
    • https://cdn.shopify.com/s/files/1/0435/9664/4511/files/22021807234.pdf
    • https://cdn.shopify.com/s/files/1/0428/2230/3911/files/37609928684.pdf
    • https://cdn.shopify.com/s/files/1/0429/4157/9420/files/kogowakogos.pdf
    • https://cdn.shopify.com/s/files/1/0433/8404/5719/files/19240527990.pdf
    • https://cdn.shopify.com/s/files/1/0434/5669/2390/files/hamoodur_rehman_commission_report.pdf
    • https://cdn.shopify.com/s/files/1/0432/6660/5211/files/11994729228.pdf
    • https://cdn.shopify.com/s/files/1/0431/5276/9192/files/53547134626.pdf
    • https://cdn.shopify.com/s/files/1/0439/5941/9038/files/74703892732.pdf
    • https://cdn.shopify.com/s/files/1/0433/0127/3750/files/78902412034.pdf
    • https://cdn.shopify.com/s/files/1/0438/4745/0789/files/dragon_s_dogma_elite_lantern.pdf
    • https://cdn.shopify.com/s/files/1/0436/7984/2457/files/lonipa.pdf
    • https://static.usrfiles.com/ugd/b8c837_40d955db258743aca8a77424d677199c.pdf
    • https://static.usrfiles.com/ugd/b8c837_483394ee66ae42fe82a0d3b3a35fe1b5.pdf
    • https://static.usrfiles.com/ugd/5be868_77b0e593a0904284a4baee7f904330f6.pdf
    • https://static.usrfiles.com/ugd/b98abb_1520dcf2252d4768a60c42fe403db174.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006c54.bin
d869650236238185df867564c2d6282629fcf6dac5ccf3b61336be847ec31a00		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6C54 5580 bytes
font_01_sfnt_off00007f4f.bin
0dd8ee0244fdc0b2dc9c5a0b8d11647e2575d63f2f1dca353331d2ddeda4c228		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7F4F 11896 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.