Malicious PDF — malware analysis report

Static analysis result for SHA-256 049d26ff4f893cdd…

MALICIOUS

PDF

43.9 KB Created: 2020-08-17 12:00:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 39383cde4fd46e223725e35c4e2f96cb SHA-1: 2d98cdcb9e01f1e98e8f600f13ec3f7d5f350e67 SHA-256: 049d26ff4f893cddb6d880c3820c02203c502d9476d2180a53d9acd4c187dd9b
202 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing for linking to known malicious redirector infrastructure, specifically `https://ttraff.ru/pify?keyword=law+cet+2019+application+form+date`. The document body also contains this URL, suggesting it is the primary lure. The presence of MFA lure heuristics indicates an attempt to harvest credentials or session tokens after redirection. No scripts were extracted, but the PDF structure and malicious link strongly suggest a phishing or credential harvesting attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 6

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • MFA / one-time-code harvesting lure high SE_MFA_LURE
    Document asks for a one-time code, authenticator approval, or MFA confirmation — consistent with credential phishing kits that steal session tokens or abuse multi-factor authentication
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=law+cet+2019+application+form+date
    • http://files.seancetattoo.com/uploads/1/3/0/9/130969699/fexux-witekegoxuze-luvilebo-bafigi.pdf
    • http://jirogutu.maryanndipietro.com/uploads/1/3/1/3/131398140/vomozazewojutan.pdf
    • http://josofatum.azffathletics.org/uploads/1/3/0/8/130814297/sokapud-dijenam-sedafojesepefu-sipexumipijusi.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0439/5496/2590/files/computational_number_theory_notes.pdf
    • https://cdn.shopify.com/s/files/1/0428/4815/7859/files/95387816422.pdf
    • https://cdn.shopify.com/s/files/1/0430/6678/5949/files/nababerejamalesevujexobet.pdf
    • https://cdn.shopify.com/s/files/1/0427/9474/6023/files/cours_algorithme_terminale_s.pdf
    • https://cdn.shopify.com/s/files/1/0431/5663/5816/files/32444885450.pdf
    • https://cdn.shopify.com/s/files/1/0430/3434/5625/files/marketing_concept_example.pdf
    • https://cdn.shopify.com/s/files/1/0432/7607/5164/files/define_reliability_in_research.pdf
    • https://cdn.shopify.com/s/files/1/0432/7541/9798/files/27485083089.pdf
    • https://cdn.shopify.com/s/files/1/0432/2027/1264/files/bahut_accha_video.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006bbc.bin
ca9aa554b63017e342a0ddb6c7cb2ab28a1baa2781fd380280deb7c5a632cd5e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6BBC 5636 bytes
font_01_sfnt_off00007ee2.bin
6607d73a514736219dae09620e1e2b6a7fd2bf74ddbc306249f7396a0a676c1d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7EE2 10532 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.