Malicious PDF — malware analysis report

Static analysis result for SHA-256 f0906046c221c55d…

MALICIOUS

PDF

67.0 KB Created: 2020-08-25 14:44:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 227ccd0f61dc3169037ee28fd36eb025 SHA-1: 50d42afb003899b0cc7286144092df8ecbb1d650 SHA-256: f0906046c221c55d189419f23640903ab31844377ae9a67a43eabc2d56a6bd22
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file exhibits characteristics of a link farm, embedding numerous external links, with a critical heuristic firing for a malicious redirector. The primary malicious URL identified is https://ttraff.ru/pify?keyword=basara+4+sumeragi. The ML classifier strongly indicates maliciousness, and the PDF structure suggests an attempt to manipulate search engine results or lure users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=basara+4+sumeragi
    • http://files.orilingo.com/uploads/1/3/1/6/131636589/6078262.pdf
    • http://files.srandhh.com/uploads/1/3/1/0/131070216/9c56d.pdf
    • http://files.discoveringsarah.com/uploads/1/3/1/3/131398125/zewamatizuzugaxag.pdf
    • http://files.techtoberfestoc.com/uploads/1/3/2/6/132681556/9747449.pdf
    • http://zorumot.yrpm.ca/uploads/1/3/0/7/130775565/763de2.pdf
    • https://cdn.shopify.com/s/files/1/0429/2627/6775/files/rixubawax.pdf
    • https://cdn.shopify.com/s/files/1/0430/9640/8218/files/nudoxiwopoxuwimidimojetas.pdf
    • https://cdn.shopify.com/s/files/1/0437/7857/2450/files/jezawabugiwivomowovu.pdf
    • https://cdn.shopify.com/s/files/1/0430/0649/2823/files/android_camera_surfaceview_github.pdf
    • https://cdn.shopify.com/s/files/1/0431/7206/9525/files/parshya_archi_ali_dj_song.pdf
    • https://cdn.shopify.com/s/files/1/0437/2021/2645/files/raxaxarikaretinuvubajuzed.pdf
    • https://cdn.shopify.com/s/files/1/0461/7076/7512/files/tajuvizenujodusemigiwukep.pdf
    • https://cdn.shopify.com/s/files/1/0440/4730/2806/files/20590744001.pdf
    • https://cdn.shopify.com/s/files/1/0428/1381/6995/files/gisigeninebura.pdf
    • https://cdn.shopify.com/s/files/1/0435/2812/6618/files/national_geographic_traveler_vietnam.pdf
    • https://cdn.shopify.com/s/files/1/0430/6839/1591/files/wawakun.pdf
    • https://cdn.shopify.com/s/files/1/0429/7916/4314/files/58769173053.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00009143.bin
f214878f3d74831a5eafbf5b3ed0968edb6925522ffc20efa93f34d51d3cfd06		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9143 17604 bytes
font_01_sfnt_off0000c9e8.bin
938baf1e03614487d1eedd4300843d69c1e2a0c9dc0b430e51c1d11564ee5b13		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC9E8 5112 bytes
font_02_sfnt_off0000db35.bin
22273978628c46be80f5f85b166d29c1ec153eb10cbfb1ad2bd4a3c227e6a28f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDB35 10376 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.