Malicious PDF — malware analysis report

Static analysis result for SHA-256 00e3d86a12487b4b…

MALICIOUS

PDF

38.4 KB Created: 2020-09-18 16:00:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: acff0dc7acf0c40fe820eb86bf4adb4d SHA-1: 5b1f7706a2407b3ff3c3186d0196c2d67b233fd1 SHA-256: 00e3d86a12487b4b094688d7533b5def48ed8355289dd9f9a99dcc32844b5bb0
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF contains a link farm designed to redirect users to malicious infrastructure, specifically identified by the URL 'https://ttraff.club/pify?keyword=national+alpaca+day+ireland'. The ML classifier strongly indicated maliciousness, and the presence of numerous external links suggests an attempt to distribute further malicious content or engage in SEO poisoning. No scripts were extracted, but the PDF structure itself is weaponized for redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/pify?keyword=national+alpaca+day+ireland
    • http://files.fibrechick.com/uploads/1/3/2/6/132681812/gedivuzexix_zukovelotewe_zelepev.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://c790d833-4993-47be-b654-542715577501.filesusr.com/ugd/f67134_ab63068a80704835be8fba31317de24e.pdf?index=true
    • https://ba80a160-7124-463f-ab93-677da9b96ac9.filesusr.com/ugd/a421e3_2a23640b728f4ab598e3287562d6815b.pdf?index=true
    • https://bb9e86e5-610d-4815-b0bf-b93a95217b8f.filesusr.com/ugd/3615fb_2d7b521bce3449a9b57c326d1b06f5a2.pdf?index=true
    • https://e542f732-5fb1-4646-8bf5-ee6cda885800.filesusr.com/ugd/9d66c7_76182f65712f402ba52967883094efd8.pdf?index=true
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/wefudebavisizaku.pdf
    • https://cdn.shopify.com/s/files/1/0429/4977/1427/files/vosajewezixedukuzugeba.pdf
    • https://cdn.shopify.com/s/files/1/0440/5064/5157/files/miwojibekepabose.pdf
    • https://cdn.shopify.com/s/files/1/0432/8456/2084/files/2671232817.pdf
    • https://cdn.shopify.com/s/files/1/0429/0769/7305/files/rolis.pdf
    • https://cdn.shopify.com/s/files/1/0434/0531/2154/files/20861282756.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004d0b.bin
451141c0ab446d61593b87d2739d71cbcb84b71175c1838b2682175bb90b7ca8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4D0B 4748 bytes
font_01_sfnt_off00005d31.bin
795fc11f7b5538b0425e10edd3240f5e14c338c99a2539c620315ee1cda0f45b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5D31 9984 bytes
font_02_sfnt_off00007f4d.bin
9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7F4D 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.