Malicious PDF — malware analysis report

Static analysis result for SHA-256 2ab41b11d3725ec1…

MALICIOUS

PDF

45.4 KB Created: 2020-09-18 14:56:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b4199bd57afee4e5ddbf75ef2c689e8d SHA-1: 10058a0edebc7f2938871f925c897c20909b99ef SHA-256: 2ab41b11d3725ec15bdb3c75b11ea2914829bc9203eec103cec2a6059d8648b6
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links, including a critical link to a known malicious redirector. The document body, though heavily obfuscated, contains the URL 'https://ttraff.link/wix?keyword=generic+profile+picture+generator', suggesting a lure related to profile picture generation. The presence of numerous external links and the ML classification strongly indicate malicious intent, likely to redirect the user to a phishing or malware distribution site.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/wix?keyword=generic+profile+picture+generator
    • http://files.myqualitylifecounseling.com/uploads/1/3/1/4/131406592/tezad-nezakij-poravifed.pdf
    • http://pixine.kerryedwardsphotography.com/uploads/1/3/1/3/131383314/7358319.pdf
    • https://e1206077-2202-4cc3-a446-28ed52b5ff71.filesusr.com/ugd/8a9bcc_fb81006652b949498c907ced6f541d0c.pdf?index=true
    • https://f361391c-03e1-489b-9abb-eedc3136172b.filesusr.com/ugd/ee9d3f_f4499725e89b4e75b862863027217dec.pdf?index=true
    • https://29f764aa-9164-40e7-997f-4ff4faa1cc96.filesusr.com/ugd/bb05c1_ffa937e744dc4a019416de8c288f4f8a.pdf?index=true
    • https://c921874a-ffd3-4d96-a4d5-6b33ac7a1422.filesusr.com/ugd/8ce377_2e7c189e371942d09bef12a27aceac22.pdf?index=true
    • https://9749d524-8539-48a4-acc9-73786a4bbdef.filesusr.com/ugd/269bb8_3d9a5bb0841642fbb11f9af4a87f977d.pdf?index=true
    • https://78ada765-943a-46d3-ace2-2ff1984f8e57.filesusr.com/ugd/65e777_b0fb70ade58f4f6ba04dcb19d5403a26.pdf?index=true
    • https://9e8324a7-ea05-410c-a455-44eb832a4e69.filesusr.com/ugd/a9e086_5f61093fd310470398524898aa8e9071.pdf?index=true
    • https://3a863b9f-0caf-4fbc-b4e9-0887657f0e05.filesusr.com/ugd/bcfc12_43a4f9c29b174cb19b7d7335a3d5bfc4.pdf?index=true
    • https://09fce9cc-7276-4d5e-a8e9-c0cebf5e1fc0.filesusr.com/ugd/7e0eb0_45f3923661d648349b0ef8a59afbb8b0.pdf?index=true
    • https://9193019b-d63d-4e61-9d9f-0b19a666c516.filesusr.com/ugd/dba42a_89fcf9546e8845b58b59e09f3f0c0356.pdf?index=true
    • https://081494dc-68fb-4602-a1b7-6ad9e12df096.filesusr.com/ugd/078c79_5cc94ab50ee44724b8902135a2f05ba9.pdf?index=true
    • https://2a347806-9409-4527-89a7-2679b7a58a82.filesusr.com/ugd/5c8b2f_d11496b102ae485c93ce68db83641811.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000062f7.bin
67b0272e52e45293065f52e630091ac6ccf48e532814fee9817bb581586622c2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x62F7 4920 bytes
font_01_sfnt_off000073c2.bin
8a82aecedf8449d3f0d475b4545ec46b21e817ef6cea583022672487475ccc21		 pdf-font-stream PDF embedded font (sfnt) at offset 0x73C2 11424 bytes
font_02_sfnt_off00009ab8.bin
a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9AB8 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.