Malicious PDF — malware analysis report

Static analysis result for SHA-256 f44439859c2a2145…

MALICIOUS

PDF

57.0 KB Created: 2020-08-19 18:45:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fdf9d3e5b7316d72dea69e652601e801 SHA-1: a5e357b144ab700fc12c010cd7655d1adb45f1a8 SHA-256: f44439859c2a2145eb05df4752970fe404a5c54f2c0d9d66baca8b2f025b388b
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a link farm with 22 external links, many of which are hosted on cdn.shopify.com and appear to be SEO-optimized. One critical heuristic indicates a malicious redirector link to 'ttraff.cc', which is used to obscure the final destination. The document body contains the string 'Anybooks apk mod', suggesting a lure for potentially unwanted applications or malware. The ML classifier strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=anybooks+apk+mod
    • http://files.thebrickva.com/uploads/1/3/2/6/132695416/mixewew-bisavupatava-weworopo.pdf
    • http://modawa.capeagents.com/uploads/1/3/0/8/130874493/fapabazub.pdf
    • https://cdn.shopify.com/s/files/1/0428/2191/0687/files/unity_load_scene_on_button_click.pdf
    • https://cdn.shopify.com/s/files/1/0428/4815/7859/files/30302791156.pdf
    • https://cdn.shopify.com/s/files/1/0440/7482/7941/files/jekepidozumedovez.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/rasebiv.pdf
    • https://cdn.shopify.com/s/files/1/0434/9073/8328/files/ccna_1_for_beginners_notes.pdf
    • https://cdn.shopify.com/s/files/1/0435/8973/0467/files/52058625494.pdf
    • https://cdn.shopify.com/s/files/1/0437/9607/0560/files/zolegijikipedururixune.pdf
    • https://cdn.shopify.com/s/files/1/0429/8221/1735/files/zaroniporimuzokenu.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/68876684382.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006d2f.bin
0eac1552a6a0cc8d6d43e14f5c157d052ff2bf21460314f67a2c213e0a454e63		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6D2F 6744 bytes
font_01_sfnt_off00007e16.bin
72c19aeff089ad5ce08c12d080c4918be6e46ba1fc2a621eeb5cbcfd6a5797e5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7E16 5272 bytes
font_02_sfnt_off00008fed.bin
5f5d3135920b878202b4462b34d0a8082c2fdb9ad2d18f9100ab1e0d1ac6297e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8FED 3168 bytes
font_03_sfnt_off00009c56.bin
7eab752a97ace6f0e09d1abef5169a3601449158a1ebc8269b8f1682457ae0b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9C56 10676 bytes
font_04_sfnt_off0000c116.bin
8fe31ac2096c5e11ca20e474ac9d4b0e624cd7c6a3d6648e58269b78a2b36287		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC116 16304 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.