Malicious PDF — malware analysis report

Static analysis result for SHA-256 43256c0ad133c34e…

MALICIOUS

PDF

42.2 KB Created: 2020-08-29 04:09:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a6b448f0174e514666c7777c91d6e722 SHA-1: 62d2ab1126daeaaa3782bf821326664117730aad SHA-256: 43256c0ad133c34ea40297bbbdb7561728075e68722a4960a2e297c808de924d
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF was flagged as malicious due to a high number of embedded links, many of which lead to a redirector service. The document body contains obfuscated text and URLs, including a link to 'ttraff.com', which is identified as a malicious redirector. This suggests the PDF is designed to lure users to malicious sites, likely for further exploitation or credential harvesting.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=2013+ford+fusion
    • https://static.usrfiles.com/ugd/b8c837_5cfb949e730748e89c0092a9809fb87d.pdf
    • https://static.usrfiles.com/ugd/b8c837_66ec3798ae87428899dc1dce723c1f64.pdf
    • https://static.usrfiles.com/ugd/b8c837_e835c8c5d900456da26b5ef66bba75af.pdf
    • https://static.usrfiles.com/ugd/b8c837_998863c5d1334780be8abf5439391b29.pdf
    • https://static.usrfiles.com/ugd/b8c837_88cab1e966274f4aa27a3ebed96c5585.pdf
    • https://static.usrfiles.com/ugd/b8c837_19d6b2351b174b71a02d7582669cccff.pdf
    • https://static.usrfiles.com/ugd/b8c837_1a12568969754dccaee4bf1f88b6d39a.pdf
    • https://static.usrfiles.com/ugd/b8c837_dad9782de13042d8bb5f05d20f83d07a.pdf
    • https://static.usrfiles.com/ugd/b8c837_50d717412911452c9e850a5bb5fc6dc9.pdf
    • https://cdn.shopify.com/s/files/1/0431/8747/0496/files/beiimaan_love_full_movie_123mkv.pdf
    • https://cdn.shopify.com/s/files/1/0435/4709/9290/files/41744129609.pdf
    • https://static.usrfiles.com/ugd/b8c837_8eb1866d71f94eedb18dda8893a49f48.pdf
    • https://static.usrfiles.com/ugd/b8c837_15da5ebc1360471ab55a8ca19d7e0308.pdf
    • https://static.usrfiles.com/ugd/b8c837_d08e66f3697f460c9e137037aa97b765.pdf
    • https://static.usrfiles.com/ugd/b8c837_67e7acd4ca64447d8afb699521dc813a.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000067f6.bin
24609f08e8c8b1d162df5de5e2b35174bdb0fac410e1ec9056e2b5df484556c1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x67F6 5052 bytes
font_01_sfnt_off00007933.bin
0459f60202fe5e99df48b00116e843d35b9e784c923834bb92f1fb39d476ee21		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7933 10232 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.