Malicious PDF — malware analysis report

Static analysis result for SHA-256 3a29f156949653ad…

MALICIOUS

PDF

44.0 KB Created: 2020-10-08 07:43:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-26
MD5: 1a5808b05669f12ccbc247f98000db35 SHA-1: eb572a9154eb9c4e12c14801ba2a4ca028f18f26 SHA-256: 3a29f156949653ad3f21955cfb05aa76d62c06d7501748e9e677d597490d8b2a
174 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link to a known malicious redirector, ttraff.club, which is likely used to funnel victims to phishing sites or malware downloads. The document also contains a large number of links to other PDFs hosted on various platforms, suggesting a link farm or SEO poisoning attempt. While no scripts were explicitly extracted, the presence of malicious links and the ML classifier's high confidence indicate a malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/pify?keyword=the+drunken+scotsman+tik+tok In PDF document text
    • http://files.sparksatthewildedge.net/uploads/1/3/1/4/131407530/accdc02a163788.pdfIn PDF document text
    • http://files.arcadianecology.com.au/uploads/1/3/1/4/131407388/9697694.pdfIn PDF document text
    • http://daneki.trailcoffeecompany.com/uploads/1/3/2/6/132681790/nofumobana_jaraza_kejopa.pdfIn PDF document text
    • http://xasasuni.englishmadeeasy.es/uploads/1/3/1/0/131070538/eef3cca734c.pdfIn PDF document text
    • http://files.konext.org/uploads/1/3/1/6/131606453/jurejasag.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://cdn.shopify.com/s/files/1/0436/0224/7838/files/93686386499.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0428/4389/8019/files/3266058925.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0496/1271/8233/files/50202084690.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0432/9062/4158/files/bugs_vs_daffy_football_y8.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5c464f79-06a5-42b5-bd37-75b13f195909/19584202608.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bb103b6e-eefc-465c-92d1-3d74064a87f1/xatoxakusamaveju.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/10f3a7aa-8115-4a7e-befe-f977a37047d9/10482651056.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0483/5298/5237/files/43347928324.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0479/6347/2028/files/dremel_polishing_kit_walmart.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0436/3649/0398/files/64971945181.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0484/3516/7400/files/93821884109.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0485/7875/6768/files/44567449958.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006dbd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6DBD 5160 bytes
SHA-256: f0d1ba1a8f6e39977fe8d4a23b239d6b2f6d308b203598cbee441150eed493ca
font_01_sfnt_off00007f1a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7F1A 10616 bytes
SHA-256: 633046e93032be2a80c7f4ab513aad6b3f532c4cf8d31338d0a238002b027322

Open this report in the interactive analyzer, or submit your own file for analysis.