Malicious PDF — malware analysis report

Static analysis result for SHA-256 fdfc400af5d327d2…

MALICIOUS

PDF

39.0 KB Created: 2020-08-10 17:56:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b628cf5a47020c543dc2240b513a8c37 SHA-1: ed8187d9ff24c8e8523e1a7a78bb01a6e47f6a08 SHA-256: fdfc400af5d327d21337e45fa22a3590af48132695d4ee8fc3e0f023110b4f47
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a heuristic firing for a malicious redirector link, specifically pointing to 'https://ttraff.com/pify?keyword=the+animator+s+survival+kit+pdf+portugues'. This indicates a social engineering attempt to direct users to malicious infrastructure. The document body, though heavily obfuscated, also contains this URL, reinforcing the lure. The presence of numerous Shopify links, while many are benign, suggests a tactic to obscure the malicious destination among legitimate-looking ones.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=the+animator+s+survival+kit+pdf+portugues
    • http://powimede.ffsdf.org/uploads/1/3/0/8/130814769/f822d4.pdf
    • http://files.experienceearth.store/uploads/1/3/1/4/131438667/bilujigu_xezejamisuko.pdf
    • http://files.ukinvestmentstamps.com/uploads/1/3/1/4/131453843/1b0052956b94.pdf
    • https://cdn.shopify.com/s/files/1/0428/2325/4179/files/bosch_steam_boiler.pdf
    • https://cdn.shopify.com/s/files/1/0433/8325/9301/files/rirexaweso.pdf
    • https://cdn.shopify.com/s/files/1/0431/3192/8740/files/lumurejukoberu.pdf
    • https://cdn.shopify.com/s/files/1/0433/8037/5710/files/vuseperamabamevekeroleg.pdf
    • https://cdn.shopify.com/s/files/1/0439/1079/1323/files/jodunutukawew.pdf
    • https://cdn.shopify.com/s/files/1/0435/0086/3643/files/lesazegorakemizeva.pdf
    • https://cdn.shopify.com/s/files/1/0434/6940/6360/files/rejugujivoxidato.pdf
    • https://cdn.shopify.com/s/files/1/0437/4790/1592/files/42350194038.pdf
    • https://cdn.shopify.com/s/files/1/0438/8136/5659/files/muwizirevofejutufov.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/23063093424.pdf
    • https://cdn.shopify.com/s/files/1/0435/4598/5192/files/fozelalevebesub.pdf
    • https://cdn.shopify.com/s/files/1/0431/3874/4469/files/cara_membuat_bookmark_dengan_adobe_reader_9.pdf
    • https://cdn.shopify.com/s/files/1/0429/3237/1622/files/jekivipumevabivomimilino.pdf
    • https://cdn.shopify.com/s/files/1/0431/3438/6332/files/85263196504.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000586a.bin
cd1f6f6489cc4078a8cf7eebe114bc7230efc68cc86e5fda12d808646d269532
pdf-font-stream PDF embedded font (sfnt) at offset 0x586A 5528 bytes
font_01_sfnt_off00006b14.bin
b138c37788566d04e4dda5746a6148e01240ae86cf9e08396c39d120f135e257
pdf-font-stream PDF embedded font (sfnt) at offset 0x6B14 10944 bytes