Malicious PDF — malware analysis report

Static analysis result for SHA-256 e04b733ad9092c69…

MALICIOUS

PDF

47.8 KB Created: 2020-09-02 22:29:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0336770dc0a58e16d3a8c6a27feecff5 SHA-1: 98c31d24d7a1f2d736ce662cc22b2b21c2fe1ecf SHA-256: e04b733ad9092c69da6dd6587c835c4f54af35895a0b1fdbbafc137a08eb69dd
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.ru/wix?keyword=anormalidades+de+los+leucocitos+pdf'. This indicates the document's primary purpose is to redirect users to malicious infrastructure. Additionally, a heuristic for a PDF link farm was triggered, suggesting a broader campaign of distributing malicious links. The ML classifier strongly supports the malicious nature of this PDF.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=anormalidades+de+los+leucocitos+pdf
    • https://static.usrfiles.com/ugd/7d1dc9_ffc3884ce7314f3c830b433f5638890f.pdf
    • https://static.usrfiles.com/ugd/d54300_6274418f9f3a4889aacc36a60e3fb984.pdf
    • https://static.usrfiles.com/ugd/cd79e3_b59d0a256ab04ef69ef5e8636b6d102d.pdf
    • https://static.usrfiles.com/ugd/2ca09c_c5acae2ca3f649018ed579b3852d8f07.pdf
    • https://static.usrfiles.com/ugd/41a0b6_667e7f63a66441ada2098f4bb3e90d0c.pdf
    • https://static.usrfiles.com/ugd/7ba596_0529d176ee6a4b6a9e82b5a270514019.pdf
    • https://static.usrfiles.com/ugd/b8c837_5d1e35c3c613448882a11ca4a22253f1.pdf
    • https://static.usrfiles.com/ugd/f967ac_1bd79417a83e4cd1a21116de7b437a0e.pdf
    • https://static.usrfiles.com/ugd/2ca22b_acad74d265cf4b5d8c158f2048c5a244.pdf
    • https://static.usrfiles.com/ugd/8acad3_bb44743079a247cea93b4b167b60f06e.pdf
    • https://cdn.shopify.com/s/files/1/0429/9217/3217/files/94220243619.pdf
    • https://cdn.shopify.com/s/files/1/0432/6057/5894/files/jovukawokugimebex.pdf
    • https://cdn.shopify.com/s/files/1/0435/1836/1755/files/jawomigupi.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007bb0.bin
6d0c95420b0ea7228f3eee78cd3cc5cd0a27df4d2deab9256f81d6b91ad0cb19		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7BB0 5288 bytes
font_01_sfnt_off00008d93.bin
8e1df21c34723fdb000c69f564067ee5b2f89ae27206633e0608543c74120e44		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8D93 10760 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.