Malicious PDF — malware analysis report

Static analysis result for SHA-256 f1a81f2bc54ad636…

MALICIOUS

PDF

36.0 KB Created: 2020-08-22 21:08:19 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: aac2ee69e5fe2e58947b1b78d6313da5 SHA-1: c60045872f8a57cecdc4cdfcefb50897bb62bfc9 SHA-256: f1a81f2bc54ad636d0bd67bd65ae8ed3800671d4fc0b4b3a823443fbdc514db7
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a significant number of embedded links, many of which point to a redirector service (ttraff.cc). This indicates a phishing or scam attempt designed to lead users to malicious content. The ML classifier also strongly flagged this PDF as malicious. No scripts were extracted, and the document body was heavily obfuscated, limiting further analysis of the exact lure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=lagu+on+my+way+dj+koplo
    • http://files.hardemanschool.com/uploads/1/3/0/7/130739783/vigofowa.pdf
    • http://baroru.earth2wallace.com/uploads/1/3/2/6/132681351/novunefaxeg.pdf
    • https://cdn.shopify.com/s/files/1/0428/1715/9335/files/40277069694.pdf
    • https://cdn.shopify.com/s/files/1/0430/7235/6514/files/bezojezirepop.pdf
    • https://cdn.shopify.com/s/files/1/0437/6982/3390/files/biology_terms_and_definitions_for_high_school.pdf
    • https://cdn.shopify.com/s/files/1/0440/4235/4853/files/52572403821.pdf
    • https://cdn.shopify.com/s/files/1/0429/8362/0767/files/blanche_neige_en_anglais.pdf
    • https://cdn.shopify.com/s/files/1/0434/1560/1314/files/60546223466.pdf
    • https://cdn.shopify.com/s/files/1/0437/6218/8449/files/wuximikuj.pdf
    • https://cdn.shopify.com/s/files/1/0432/3331/2925/files/que_son_canales_de_distribucion.pdf
    • https://cdn.shopify.com/s/files/1/0431/0564/8801/files/belurek.pdf
    • https://cdn.shopify.com/s/files/1/0441/4049/5000/files/classifying_triangles_notes.pdf
    • https://cdn.shopify.com/s/files/1/0437/7044/5975/files/musobaxeweravitu.pdf
    • https://cdn.shopify.com/s/files/1/0437/7326/4030/files/maths_formulas_for_class_11_state_board.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000042c1.bin
b50fd98fa893b366319c3755cc55bcee732fa9adef0de2591d3795acd06aca2d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x42C1 4916 bytes
font_01_sfnt_off00005381.bin
1e327564c19c73a5ccb9d57abc0adaa6eaf1ba04835da6faf43fd4df4b998fd1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5381 9896 bytes
font_02_sfnt_off00007543.bin
7f6049e5011acf0e8581793f2bc2bb947aac2929fdb77abc318b2a6155c1ef71		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7543 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.