Malicious PDF — malware analysis report

Static analysis result for SHA-256 034f0ae61d11f01e…

MALICIOUS

PDF

44.8 KB Created: 2020-09-02 00:03:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 34bc1ff3df9711a87b6b12b101f5b9a5 SHA-1: 78027baecd238a04926ee3c1fce6a9ef827e7c8e SHA-256: 034f0ae61d11f01e95477da80e0d2d82244acc8291453a15b60bebac6f1b916f
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document contains a large number of embedded links, many of which point to a link farm designed to redirect users to malicious infrastructure. The primary malicious URL identified is https://ttraff.cc/wix?keyword=cultural+anthropology+journal+pdf, which is flagged as a known malicious redirector. The document's content and structure suggest a phishing or scam attempt, leveraging a seemingly academic topic to entice clicks.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=cultural+anthropology+journal+pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0430/4365/1741/files/43080980621.pdf
    • https://cdn.shopify.com/s/files/1/0432/8259/6004/files/88972220.pdf
    • https://cdn.shopify.com/s/files/1/0440/0329/5382/files/discrete_mathematics_ensley.pdf
    • https://static.usrfiles.com/ugd/b8c837_1a1b385dfa724ded9c2d146353f6fa11.pdf
    • https://static.usrfiles.com/ugd/c1615c_9be4ea620a954be2918795c844771ee4.pdf
    • https://static.usrfiles.com/ugd/36d413_a11f769b7036478d8c213f2f6eb40f7b.pdf
    • https://static.usrfiles.com/ugd/cafc24_72acc96a4c524f02a2cb55784f63ace7.pdf
    • https://static.usrfiles.com/ugd/804ff6_2093cdfcb5ef41e8a4e32a13849ab556.pdf
    • https://static.usrfiles.com/ugd/a4e402_b26739660244455e93619db01dbb34d8.pdf
    • https://static.usrfiles.com/ugd/1f6d71_770627593ee145c68ac04c7b6125e684.pdf
    • https://static.usrfiles.com/ugd/b8c837_63d90ac156de4c11bdc0aa0bbbf60d20.pdf
    • https://static.usrfiles.com/ugd/0779a3_89e7f299093a4aa6ad96f7a43e21bf30.pdf
    • https://static.usrfiles.com/ugd/c3548c_1645b9cbc00747ac85f3c3da89f7b511.pdf
    • https://static.usrfiles.com/ugd/6812d7_360feaf9e14840b4971267fa52536e40.pdf
    • https://static.usrfiles.com/ugd/ace02d_8ef70246e2a5424cb2eed973a8e932eb.pdf
    • https://static.usrfiles.com/ugd/0a052f_4d5e43f193d04180a2275f956dfeef0f.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006553.bin
2d3c702acb99397e4a80293ce21406bf68387accb303fc73bba2ed0f04a971da		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6553 5208 bytes
font_01_sfnt_off00007710.bin
10b37a227bf3b90349c5ace84bf6f17bab338a6fe2ca749e549089d7163cf510		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7710 15384 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.