Malicious PDF — malware analysis report

Static analysis result for SHA-256 4a9b8de80189ce93…

MALICIOUS

PDF

41.3 KB Created: 2020-10-30 14:22:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8231dcae7ea36a1cfe6867716d468458 SHA-1: d30992cc80a593d11f5924a7b63d8cc7e347672f SHA-256: 4a9b8de80189ce932f2501a6a730ec9968c1f1d10079fb9354ba8b3cc1294e1b
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing for a malicious redirector link, which is also present in the document body and the extracted URLs. The ML classifier strongly flagged this PDF as malicious. The embedded link, https://ttraff.link/123?keyword=fitbit+ionic+answer+calls, is the primary indicator of malicious intent, likely leading to a phishing page or malware download.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/123?keyword=fitbit+ionic+answer+calls
    • https://bizumoku.weebly.com/uploads/1/3/2/6/132681494/bokadox.pdf
    • https://xumogimunosu.weebly.com/uploads/1/3/1/6/131607683/0babbd86b6994.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/damerirazib/silug.pdf
    • https://uploads.strikinglycdn.com/files/29ce7841-62a7-43da-b11f-9f0ac72998d2/69500906203.pdf
    • https://uploads.strikinglycdn.com/files/5b75df8d-2e3c-4ef0-a8ac-d5a06fb1541d/the_fairly_oddparents_watchcartoononline.pdf
    • https://s3.amazonaws.com/niporofez/74201229784.pdf
    • https://cdn.shopify.com/s/files/1/0501/4926/1500/files/zippo_hand_warmer_power_bank_instructions.pdf
    • https://s3.amazonaws.com/pazifetanegapu/difference_between_business_and_entrepreneurship.pdf
    • https://uploads.strikinglycdn.com/files/8834090a-bffc-45ab-b0f6-fe56ad2a16db/nipabegemufo.pdf
    • https://cdn.shopify.com/s/files/1/0430/3339/5353/files/wajudefem.pdf
    • https://s3.amazonaws.com/tesodagiwor/unblocked_66_ez_slope.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006319.bin
583b9f53cd9e9182b4f34aba5459176727d223ad56742d3e9fcacab0399ba814		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6319 4980 bytes
font_01_sfnt_off00007429.bin
b75ae67d10a4f67b20e9556bdab319571a864d72a2d97f5d26f2a74cdcdf2652		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7429 10788 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.