Malicious PDF — malware analysis report

Static analysis result for SHA-256 f9a006fccbaa8ba3…

MALICIOUS

PDF

78.4 KB Created: 2020-09-14 17:46:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d1779f9b1f58bffc27610c349ed2dda3 SHA-1: 74b30a11fdf3dd2a84c76b63dcb7ea5294cce231 SHA-256: f9a006fccbaa8ba33b4154f645209186df582c61fa920ab94aca1a4d84d3c755
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains numerous embedded links, with a critical heuristic identifying it as a malicious redirector. One of the primary links directs to 'ttraff.ru', which is flagged as malicious. The document body, though heavily obfuscated, contains references to this URL and other Shopify links, suggesting a coordinated effort to drive traffic to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wb?keyword=gen%203%20pokemon%20type%20chart
    • https://cdn.shopify.com/s/files/1/0434/2182/7222/files/77944522405.pdf
    • https://cdn.shopify.com/s/files/1/0432/7905/7056/files/bioshock_infinite_elizabeth_song.pdf
    • https://cdn.shopify.com/s/files/1/0428/9875/1641/files/kievan_rus_game_guide_android.pdf
    • https://cdn.shopify.com/s/files/1/0432/5477/5970/files/birla_carbon_sustainability_report_2017.pdf
    • https://cdn.shopify.com/s/files/1/0438/3696/5026/files/redacted_mystery_report_harry_potter.pdf
    • https://cdn.shopify.com/s/files/1/0435/1351/2100/files/dubarafe.pdf
    • https://cdn.shopify.com/s/files/1/0430/0495/2735/files/81159365880.pdf
    • https://cdn.shopify.com/s/files/1/0428/7329/0908/files/43749061813.pdf
    • https://cdn.shopify.com/s/files/1/0434/0006/9283/files/82628362592.pdf
    • https://cdn.shopify.com/s/files/1/0432/0083/9842/files/46429092741.pdf
    • https://cdn.shopify.com/s/files/1/0431/1384/0793/files/22795119127.pdf
    • https://cdn.shopify.com/s/files/1/0436/4887/6702/files/aleister_crowley_book_of_law.pdf
    • https://static.usrfiles.com/ugd/b8c837_3c110e82de454fb2bef28a9e1e904a6a.pdf
    • https://static.usrfiles.com/ugd/a640e9_e7e063a8eb6242ab9f7626feb2a7c79f.pdf
    • https://static.usrfiles.com/ugd/9f6a24_04b8203720184056bcf6e2125698c888.pdf
    • https://static.usrfiles.com/ugd/b8bbd7_2aade48979c04a67b74476be8d84da9d.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000bb13.bin
0916feea74e357650b38f2249bbb3e3e155c96a1a8a69bb886e4b65278dc31f6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xBB13 18968 bytes
font_01_sfnt_off0000f362.bin
603cba49ffbea18d12c62b72efbb12ae6cb2b8d3c2afe91d23d892eb86ceaa56		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF362 5324 bytes
font_02_sfnt_off00010565.bin
f19dde67e7b0c2e017613bd370908fb960f9b4c8580198dcee90c0127c85993f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10565 11896 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.