Malicious PDF — malware analysis report

Static analysis result for SHA-256 460dbc8683954669…

MALICIOUS

PDF

113.3 KB Created: 2020-09-03 06:02:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9f6d42f4d5d288c4fd271e6d4b125cfb SHA-1: 651cd51a5b6a46409c109745a731cafa1fbf2a3e SHA-256: 460dbc8683954669bf9ff039fcab55ecea508bbcdabdb83e2b5d0414db5c4c6c
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by multiple critical heuristics for containing malicious redirector links and a large link farm. The primary malicious URL identified is https://ttraff.me/wix?keyword=upkar+1967+movie+songs, which is likely used to direct users to further malicious content. The embedded document body text, though heavily obfuscated, also contains this URL, reinforcing its role in the attack. The file's structure and the nature of the heuristics suggest a social engineering attack aimed at directing users to malicious websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=upkar+1967+movie+songs
    • https://static.usrfiles.com/ugd/941881_2d4dd258f0d64bf0b22cc265f473eeef.pdf
    • https://static.usrfiles.com/ugd/b8c837_dc6dd03b97a1489d91a051f65fcee5ea.pdf
    • https://static.usrfiles.com/ugd/cdfdba_5c34585ec578425ca0f664dd768de43c.pdf
    • https://static.usrfiles.com/ugd/3b47cb_4ce63f91d36b4e2196a1b48d164cd874.pdf
    • https://static.usrfiles.com/ugd/d4da64_cfcc4651e4ec4f9981d5be589dce7a23.pdf
    • https://static.usrfiles.com/ugd/912de2_3b9022faa6be41e4853bf05b174f25d2.pdf
    • https://static.usrfiles.com/ugd/a2ebd8_156171ad16214e5ab67e458c26713cb9.pdf
    • https://static.usrfiles.com/ugd/c83fdb_7acbcefbed654da88b6e166123be5a06.pdf
    • https://static.usrfiles.com/ugd/b8c837_43554f5a9baa44ce93ba3a9b8d3bfc90.pdf
    • https://static.usrfiles.com/ugd/e1d12c_482d6ff667114eeb8452c1bae0a04e2d.pdf
    • https://static.usrfiles.com/ugd/74e905_ceffbf4317844d7c81253b26f2610fbe.pdf
    • https://static.usrfiles.com/ugd/b8c837_c4561c2183f94120b0ed500ba06b6d3c.pdf
    • https://static.usrfiles.com/ugd/4826f5_0a3412317ffe41bd8728e50983ebab71.pdf
    • https://static.usrfiles.com/ugd/eb6612_5de082a5461847f18b1bfba3fe052628.pdf
    • https://static.usrfiles.com/ugd/a59130_9ba4b7932b3f4e569982a6a3e7b46233.pdf
    • https://static.usrfiles.com/ugd/d8e941_5e17863348a54474bb79c70fc453d64b.pdf
    • https://static.usrfiles.com/ugd/8a419d_3950fe29049a408c8d1bcb338ba2508f.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000109f4.bin
e3b617bd651bc8ed61dc9a0d94dee0f629742e769602cf0c8b36bfede5aef84a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x109F4 22900 bytes
font_01_sfnt_off000152b6.bin
88f6abe3d6a48b86f2bc5aed6a64c931780c6ed912ab47dab3d3a2e6def74791		 pdf-font-stream PDF embedded font (sfnt) at offset 0x152B6 5664 bytes
font_02_sfnt_off00016604.bin
96f9bcee8018abdccdd47b370f1566a5b62c7d961b1858e0b847877f5cb7a950		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16604 15396 bytes
font_03_sfnt_off0001962e.bin
c41fc46809d2260d2d1a821cef6bb00dae560fdbad380da94a93f29d012df54e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1962E 16164 bytes
font_04_sfnt_off0001ab7f.bin
2e81d78f2ff24a5a8bff56dbc6515ab7fbc8acfd5883df306d4a63fceaa3e1d2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1AB7F 2828 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.