Malicious PDF — malware analysis report

Static analysis result for SHA-256 dc2d1565052c88b0…

MALICIOUS

PDF

45.6 KB Created: 2020-08-30 06:26:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 062c5fd08eaca82b7ffdf3cb3b78fa33 SHA-1: 01f121c0208b2a49535bf3c615bfd5482d8eca45 SHA-256: dc2d1565052c88b0864b8cedd0e10463ebd9aec23f0a08a39c20a970b0f4f94b
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a significant number of embedded links, with a critical heuristic firing for PDF_MALICIOUS_REDIRECTOR_LINK and PDF_SEO_LINK_FARM. One of the primary URLs, https://ttraff.com/wix?keyword=Lebkuchen+Frau+Lied, is flagged as a malicious redirector. The document body is heavily obfuscated, but the presence of numerous links suggests a delivery mechanism for malicious content or phishing attempts.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=Lebkuchen+Frau+Lied
    • https://cdn.shopify.com/s/files/1/0427/7692/0220/files/18248075151.pdf
    • https://cdn.shopify.com/s/files/1/0447/8281/3341/files/binomial_coefficient_properties.pdf
    • https://cdn.shopify.com/s/files/1/0433/0258/4480/files/xarefefabigipuxedo.pdf
    • https://cdn.shopify.com/s/files/1/0438/3549/0461/files/50134412214.pdf
    • https://cdn.shopify.com/s/files/1/0432/5743/0176/files/protection_domain_5e.pdf
    • https://cdn.shopify.com/s/files/1/0438/0744/1053/files/anemias_hemoliticas_en_pediatria.pdf
    • https://cdn.shopify.com/s/files/1/0429/3279/7603/files/32760536638.pdf
    • https://cdn.shopify.com/s/files/1/0433/6159/9656/files/tween_machine_maya.pdf
    • https://cdn.shopify.com/s/files/1/0431/4392/1820/files/mosuxi.pdf
    • https://cdn.shopify.com/s/files/1/0433/8624/1189/files/glossary_of_social_science_research_terms.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/99640144283.pdf
    • https://cdn.shopify.com/s/files/1/0454/0878/0456/files/zufagejikipuwegodavat.pdf
    • https://cdn.shopify.com/s/files/1/0440/0611/3430/files/gegijaxuxuxejoveroni.pdf
    • https://static.usrfiles.com/ugd/b8c837_67710c0cfd694f7d96f786230b9ed7a9.pdf
    • https://static.usrfiles.com/ugd/ac51ce_a37a908ae77d43528b4d2cdcb03fb16b.pdf
    • https://static.usrfiles.com/ugd/b8c837_90ef7077c26f44208d40ebf7a02028cd.pdf
    • https://static.usrfiles.com/ugd/97368a_84faac1b30694bae831d6ea773add1cc.pdf
    • https://static.usrfiles.com/ugd/b8c837_c20eb92b6cb9488897b5fdd42d1e0f5c.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007104.bin
ab093159dcb44abf6f7decb467bf63de49b914e267228a654c7f661d4ad390b2
pdf-font-stream PDF embedded font (sfnt) at offset 0x7104 5012 bytes
font_01_sfnt_off00008201.bin
41cc8aee52372ede58c04016c51f81dcf01c6607a87a0337d9729cf3a4cca26e
pdf-font-stream PDF embedded font (sfnt) at offset 0x8201 12604 bytes