Malicious PDF — malware analysis report

Static analysis result for SHA-256 dddf32f79e97a185…

MALICIOUS

PDF

50.7 KB Created: 2020-08-31 05:04:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: aaf99c6f51a403728eafa127bca0ca93 SHA-1: ea00879d1f09321f3b845f85f5691b4319aeef83 SHA-256: dddf32f79e97a1859ec350b1fcbe4225843d1e4b470f60007fcc9b1dedd4fd7f
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a malicious redirector link disguised as a book summary. The heuristic PDF_MALICIOUS_REDIRECTOR_LINK confirms the link points to known malicious infrastructure. The PDF_SEO_LINK_FARM heuristic indicates a large number of external links, many of which are benign but serve to obscure the malicious one. The ML classifier also strongly flagged this PDF as malicious. No scripts were extracted, but the presence of the malicious URL is sufficient evidence of a phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=resumo+do+livro+defendamonos+dos+deu
    • https://cdn.shopify.com/s/files/1/0428/1755/2543/files/detukajuwadu.pdf
    • https://cdn.shopify.com/s/files/1/0428/1804/4070/files/befed.pdf
    • https://cdn.shopify.com/s/files/1/0433/8240/7318/files/25594792408.pdf
    • https://cdn.shopify.com/s/files/1/0431/2891/4087/files/circle_cutting_template_for_router.pdf
    • https://static.usrfiles.com/ugd/ea9bdf_63d2c696c4684f9ab17fe43680c471f5.pdf
    • https://static.usrfiles.com/ugd/b8c837_6f843f2230d04802a9bf72260ef7aaef.pdf
    • https://static.usrfiles.com/ugd/bdeb4c_8d4a23aebd3b4237a7e788ad3525c005.pdf
    • https://static.usrfiles.com/ugd/cc14e4_618545ad7a62475da5991de7c9f428e8.pdf
    • https://static.usrfiles.com/ugd/b8c837_425f876c42304fc58deadb6123b02bf4.pdf
    • https://static.usrfiles.com/ugd/b8c837_d51f0409b5254051a863753429337874.pdf
    • https://static.usrfiles.com/ugd/b8c837_1d59d9824acd44759d7d5674e6c53952.pdf
    • https://static.usrfiles.com/ugd/d5415a_97cf8341a74541eeb43ec44be88ac379.pdf
    • https://static.usrfiles.com/ugd/1813b3_8eb2ad4de2e9430bb36fc25cf7d20f07.pdf
    • https://static.usrfiles.com/ugd/b8c837_3ff9788c1ca747e0bfb57631ec50b7d4.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000084f8.bin
c714e84ec92f9151ffb487899c810ec5b72d6fc4cdaa60e30299030234ed8f47		 pdf-font-stream PDF embedded font (sfnt) at offset 0x84F8 5120 bytes
font_01_sfnt_off00009658.bin
b9e6d5c29231cc0bacff442db7262198be3479c07ce0440ff208768e63381d2d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9658 12544 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.