Malicious PDF — malware analysis report

Static analysis result for SHA-256 d98e53509a597ca2…

MALICIOUS

PDF

49.4 KB Created: 2020-09-18 18:00:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9c324c5bdc6643ca3635770cf4198821 SHA-1: d9b92d18e3d6d3b87acf991b42f0eff4fdc86c03 SHA-256: d98e53509a597ca23db2bfd5998ce1d1fab78c30e21da1992a687d491ee4273d
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.me/wix?keyword=tablo+pieces+of+you+pdf'. This indicates the primary intent is to redirect the user to a malicious site. The presence of a large number of embedded links, including many benign Shopify URLs, suggests a tactic to obscure the malicious link or engage in SEO spam. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=tablo+pieces+of+you+pdf
    • http://files.road2fullframe.com/uploads/1/3/2/6/132682745/a739c80840559d.pdf
    • http://nokegok.bucklesandbeads.com/uploads/1/3/0/8/130814328/5987729.pdf
    • http://lawaxuf.rejoicezimbabwe.com/uploads/1/3/1/8/131871726/2759012.pdf
    • http://files.ajlegalaustralia.com/uploads/1/3/0/7/130740504/dapiritususuf.pdf
    • https://cdn.shopify.com/s/files/1/0432/1463/5171/files/taleemi_calendar_2019-_20_punjab.pdf
    • https://cdn.shopify.com/s/files/1/0484/6030/0442/files/michael_kors_skyler_silver_watch.pdf
    • https://cdn.shopify.com/s/files/1/0432/3855/5805/files/cash_drawer_balance_sheet_excel.pdf
    • https://cdn.shopify.com/s/files/1/0481/5611/5093/files/maytag_gemini_electric_double_oven_manual.pdf
    • https://cdn.shopify.com/s/files/1/0432/5448/1054/files/88625447920.pdf
    • https://f5608f6a-8098-4d14-b820-44e448420b9e.filesusr.com/ugd/c70c35_02d988a1d3124af3a114a2eea7a3e5a7.pdf?index=true
    • https://e804c028-9d5e-45eb-bb6e-96328942221b.filesusr.com/ugd/8d5d69_6d1d9b661c0149e29b2a6a666f685d21.pdf?index=true
    • https://82ced9ea-0aef-48fc-a339-2fd0ad384135.filesusr.com/ugd/90423f_8081de3434ef4cb1b154cb7ee2c93c9a.pdf?index=true
    • https://9d26eb6e-4748-4366-b3e6-a3d4e8ef59d1.filesusr.com/ugd/d1fcfc_dc7dd37275b04523878fb2ed74798818.pdf?index=true
    • https://cdn.shopify.com/s/files/1/0428/4946/8582/files/bazz_song_pagalworld.pdf
    • https://cdn.shopify.com/s/files/1/0427/7207/0556/files/38795968404.pdf
    • https://cdn.shopify.com/s/files/1/0431/3209/2573/files/absite_review_free_download.pdf
    • https://cdn.shopify.com/s/files/1/0430/3850/7169/files/90431287501.pdf
    • https://cdn.shopify.com/s/files/1/0430/5059/8562/files/36957006876.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007466.bin
871524d065b4e8942b6f6cd6cadc73ed16bce659f5910b39689eb9f0c7b2d0d1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7466 3824 bytes
font_01_sfnt_off00008233.bin
9b321a294d971f9a29ab0244517339898e225dda269cd7c36908cd0b28d68f22		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8233 5244 bytes
font_02_sfnt_off00009420.bin
12a195ff4012282d5a0bbad299e3aaede1e91932e60e23dd57eecd02a9922e2b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9420 10120 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.