Malicious PDF — malware analysis report

Static analysis result for SHA-256 3f20dc33e080ed7e…

MALICIOUS

PDF

41.7 KB Created: 2020-09-22 01:45:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: edb5abe3315b2d6ccf1b3955b404b5e8 SHA-1: e6bd2a13d36627e2c99e4313061f187a655012fe SHA-256: 3f20dc33e080ed7e028ccebb8491420f03bfea06986c095ce5c38a5c5e495def
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by multiple critical heuristics for containing malicious redirector links and a link farm. The document body, though heavily obfuscated, contains URLs that are consistent with the heuristic findings. The primary malicious URL identified is https://ttraff.link/wix?keyword=the+young+housewife+poem+analysis, which likely serves as a lure or initial stage for further malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/wix?keyword=the+young+housewife+poem+analysis
    • http://ridifir.loveadelyn.com/uploads/1/3/0/9/130969525/5402300.pdf
    • http://juripel.elbeephotography.com/uploads/1/3/0/9/130969011/84311df6.pdf
    • https://b2c5ca65-ad94-4238-9a23-554e68a4f220.filesusr.com/ugd/0d9a50_d92b3f97fbe2403ab88adcb869579206.pdf?index=true
    • https://08a8bcc5-7d59-4b1d-aa58-33761baa5b9f.filesusr.com/ugd/957c7b_fa6ab74b11164852ad6f595f2c2fc453.pdf?index=true
    • https://6c5a9b73-13ff-4051-8620-6212e410cb96.filesusr.com/ugd/dcf9ad_ed9a87b86d9040a7a2959d1d5dc21e46.pdf?index=true
    • https://a8d7ef85-f2b8-47a2-95e7-2981f01f6fc9.filesusr.com/ugd/bb10c5_3fbe1b5ba8494ea4bbca9a731e70f024.pdf?index=true
    • https://8a80f618-984a-44f7-8ba6-34dfefc04c98.filesusr.com/ugd/76156b_a4a231ccb17f4d0b8ef9eb430f148c96.pdf?index=true
    • https://9e7f2738-3cad-4c47-8fee-8dd85ace8a56.filesusr.com/ugd/c618e9_e0cd134c924b418fbee350ba30af62c0.pdf?index=true
    • https://ca2cd786-889b-4375-902b-910677dbb545.filesusr.com/ugd/9374a7_d4d9527c6a954e169e59110063715c25.pdf?index=true
    • https://4a6a9efa-428e-4616-ba4f-6b023b91975e.filesusr.com/ugd/97634b_2be8f3541ea44a6389bc7096251a9f91.pdf?index=true
    • https://2e5fe9a8-1c02-434a-8380-964250759f00.filesusr.com/ugd/b77b08_7e0c3abfebc34bb0aff0ccbf48758a45.pdf?index=true
    • https://8c783e16-b44b-494f-8fd7-af71afd64437.filesusr.com/ugd/0bcf16_679e8af714a14455835173bc5b2c30e1.pdf?index=true
    • https://df32483a-38ad-4f5a-b467-72ea5b899759.filesusr.com/ugd/fd30ac_f258154385434502bb383a809b2699ac.pdf?index=true
    • https://1007d8e2-e3a1-4248-b45a-56974ea74885.filesusr.com/ugd/ae15ca_fc0c5ba19e0448539ed632b32ddb4f82.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006657.bin
9488bfd959984f8f9643821e936826c4097032a2dbc6a7f9bae088ed2a8b7308		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6657 5364 bytes
font_01_sfnt_off00007893.bin
abb50a79fa42fee86ebae466de936b4098c362d8ed83f0584e6f0963990e7ada		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7893 10296 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.