Malicious PDF — malware analysis report

Static analysis result for SHA-256 3ff0103c96e5559a…

MALICIOUS

PDF

102.6 KB Created: 2020-09-16 16:49:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 18fec9de5660cfa26e185247b3896514 SHA-1: 6d5356df4b21c6e7e18ec7a38adde3b3445f165a SHA-256: 3ff0103c96e5559acd3a7c72027134a73e78d43a964aa6ee66a5c2fc7016d8a8
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by multiple critical heuristics for containing a malicious redirector link and a link farm. The ML classifier also strongly indicated maliciousness. The embedded URL 'https://ttraff.link/wix?keyword=3+levels+of+inquiry+in+philosophy' is likely the primary malicious destination, while the numerous other links contribute to a link farm strategy, potentially for SEO manipulation or to host further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/wix?keyword=3+levels+of+inquiry+in+philosophy
    • http://lerizire.frbeanmanufacturing.com/uploads/1/3/1/6/131606263/665474cd961c.pdf
    • http://files.merchantsmrkt.com/uploads/1/3/1/4/131438439/xijubezeboko_xogid_vukedogikefadud.pdf
    • http://jikuwe.ndglc.com/uploads/1/3/1/4/131437318/6f1e636.pdf
    • http://muxex.aghortteachers.org/uploads/1/3/1/3/131381706/fd78a3dd1b96c.pdf
    • https://6d81ce6b-ddfa-4a24-8c0f-6b3132c99ddf.filesusr.com/ugd/7ad284_702695ef07c94d8e8f4bb7552a126d27.pdf?index=true
    • https://0bfaad4e-7eeb-4321-a88f-0040188dae63.filesusr.com/ugd/3283b0_fce1aca0df9f495d9e6c7d232cd1c97d.pdf?index=true
    • https://d6f437c6-fe27-4a04-b714-3b8c3a20a384.filesusr.com/ugd/8ce377_730d152615b54e20968af59795897fe3.pdf?index=true
    • https://84a7627a-c357-4b4a-8984-484510b16cda.filesusr.com/ugd/277b62_bbe7d80305844bc2bdcfc554f3ea53d8.pdf?index=true
    • https://494d5c9c-3482-438d-8bf1-f9182e84b8fb.filesusr.com/ugd/f1780b_5087df127cdb48dbbef7aa78271659ce.pdf?index=true
    • https://f54745e2-0c93-4ed5-8c1e-ceba67b8b171.filesusr.com/ugd/6924eb_5d3e2bf4fc364b3c93ecd55ca67e9066.pdf?index=true
    • https://7ae49176-0174-4cf3-8ae5-fde30fa7fd24.filesusr.com/ugd/f08e01_ab024f7090bf47e3a1b718d16d38400b.pdf?index=true
    • https://e7ca3b34-7944-4a31-811f-20d0d46ffe4d.filesusr.com/ugd/91e123_e28e2a63e8f54f868c83a94eda5d66da.pdf?index=true
    • https://f7beb0ba-2ecf-47d0-9693-bd6c0e412035.filesusr.com/ugd/8db125_034a51fd64bb4a2d90948b12a5921fa0.pdf?index=true
    • https://d77115f0-61d7-43c1-ab84-25b37030d70c.filesusr.com/ugd/e948c1_b28cad20040f451c8d5fb0bcc8903b6e.pdf?index=true
    • https://0f5995ec-7d30-4793-8091-461e1e387be9.filesusr.com/ugd/c268f7_6483e94b02854440abe446731a3d83df.pdf?index=true
    • https://23c0ce91-425c-456a-a01b-e61be39186da.filesusr.com/ugd/145364_7f5a76bb3be4400fb9673fff95193457.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001508f.bin
188eabc0357e86e83baf7c8d3a976ca0092755537b012685e341a275dbfec6fc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1508F 5136 bytes
font_01_sfnt_off00016219.bin
705a68978c31ea976964a5c4a556caeff22f45afec02902433236f27bb90110b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16219 13324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.