Malicious PDF — malware analysis report

Static analysis result for SHA-256 2642f5d26adec4b8…

MALICIOUS

PDF

128.0 KB Created: 2020-09-18 05:46:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e0d726e710a332190e25933df5607dd1 SHA-1: b88568283b6b938832f28b8d60fc2319602e039c SHA-256: 2642f5d26adec4b8df21d4c45d93050f1f5cfeba2bbfceaf6b29090bd3868be1
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF file was flagged by multiple critical heuristics indicating malicious redirector links and a link farm. The primary malicious URL identified is https://ttraff.ru/pify?keyword=pathfinder+amulet+of+mighty+fists+grapple, which is part of a larger link farm. The ML classifier also strongly indicated maliciousness. No scripts were extracted, but the presence of numerous embedded links points to a delivery mechanism for further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=pathfinder+amulet+of+mighty+fists+grapple
    • https://2c331f6e-1937-4200-acb1-c032ca8515d7.filesusr.com/ugd/1e4819_13a08bde08c44ec8b6ac56564de78111.pdf?index=true
    • https://2fb362b9-aad4-432d-b3c4-e3e858b7fa15.filesusr.com/ugd/bfbc46_d262265c7cd94dd1b291933fda2a334d.pdf?index=true
    • https://ff418a29-58d0-4376-ba03-8aa8f3b42fc0.filesusr.com/ugd/314c35_bb142d052e0c4936b764517b35647765.pdf?index=true
    • https://aa9b1979-eca6-4df8-8216-9f18c43a5738.filesusr.com/ugd/93971e_b41314ab85f94c78bd3bcbbe170c19e0.pdf?index=true
    • https://ff40978c-fbef-485b-89e1-f2c00a41d826.filesusr.com/ugd/ced2dc_9c3a93c9262b4f449a55cc9d875980b0.pdf?index=true
    • https://e1b73010-4c62-4025-b2ef-4db8fce9e42d.filesusr.com/ugd/162fe6_a7c574f2f5744e589d763b0abf770233.pdf?index=true
    • https://d07410bd-d8c3-4b71-abec-308c3b1b49ac.filesusr.com/ugd/5be868_e6b6822c35b64e36a6299a22caccff1a.pdf?index=true
    • https://1a4eaf9d-85ee-4d5d-b0f0-e781b1b85bd8.filesusr.com/ugd/b42fd6_5ae8299cffa84ea6a93b4047080640c9.pdf?index=true
    • https://380247e1-62d5-4086-aa0c-3463ac95ac49.filesusr.com/ugd/82d61e_e0e9eeae65cc4aea9da30eee50ce5b87.pdf?index=true
    • https://ad00cd78-8c09-4965-bfdc-1fa669f5a022.filesusr.com/ugd/610d21_a1f7a8a51ccb41db8387dbaf65897fc5.pdf?index=true
    • https://00811347-8a3d-4afe-9563-e5feac323647.filesusr.com/ugd/0cd019_bc28e9982a0e445ab44c21a20c50d941.pdf?index=true
    • https://b17ca747-9e50-41e6-9537-443d14278feb.filesusr.com/ugd/db93e9_eedfc83f9e194c31ac923d8f816db555.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001b7ed.bin
67708721d739525ed09a436c975ec6a1fd210a5ac9a6b325bd3d6ac8824bc8ed		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1B7ED 5556 bytes
font_01_sfnt_off0001cabb.bin
37b74fada650850cad1a80d787e49b4cd542aa8b10d572fb871020103c8a0a91		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1CABB 11740 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.