Malicious PDF — malware analysis report

Static analysis result for SHA-256 54154478d5d881c6…

MALICIOUS

PDF

49.0 KB Created: 2020-09-01 04:16:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 26f1e4bfb1b2195684c1d9ddcbee982e SHA-1: 5d6b363d97fb461e1d4d0752c29389479aa4e790 SHA-256: 54154478d5d881c6f23d575224b6448bcbd6c2f835ff82f635b77a2f91f3f668
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged as malicious by a machine learning classifier and contains a critical heuristic indicating it links to known malicious redirector infrastructure. It also exhibits characteristics of a PDF link farm, with numerous embedded URLs pointing to external resources. The primary malicious URL identified is ttraff.ru, which is likely used to funnel users to further malicious content. The document body contains garbled text and what appears to be a keyword search term, suggesting a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=3d+picture+android+facebook
    • https://cdn.shopify.com/s/files/1/0431/8740/4968/files/regency_theater_yuma_az.pdf
    • https://cdn.shopify.com/s/files/1/0431/5322/7936/files/facebook_sign_up_free.pdf
    • https://cdn.shopify.com/s/files/1/0432/1283/2931/files/malajatenugifojuzaxomiz.pdf
    • https://cdn.shopify.com/s/files/1/0437/1818/1013/files/48026337176.pdf
    • https://cdn.shopify.com/s/files/1/0430/7304/4634/files/paxen.pdf
    • https://cdn.shopify.com/s/files/1/0469/2597/1611/files/nigewoxujuxatasag.pdf
    • https://cdn.shopify.com/s/files/1/0434/6170/5888/files/wugesenizuxafumalezuvu.pdf
    • https://static.usrfiles.com/ugd/77d535_61b0ea36e2af4483b081c0cb7600b00e.pdf
    • https://static.usrfiles.com/ugd/b8c837_c207b765a0f34def87e54e84cc07233c.pdf
    • https://static.usrfiles.com/ugd/f3cb45_6c3e3add21af4d59b7ece8b178570e32.pdf
    • https://static.usrfiles.com/ugd/e2c6c1_301576996fd648509d74c31a38f682f5.pdf
    • https://static.usrfiles.com/ugd/f14cf6_16fce82fd05e40fa831d0215ef82b82b.pdf
    • https://static.usrfiles.com/ugd/b8c837_998c35b929f94114bcb44703786bc381.pdf
    • https://static.usrfiles.com/ugd/405339_4e96b09555af44dcacb857797e27d3f9.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_005_off00009997.bin
d3fb86ff0aceb37165c5c4ba0a2920bcd17894439338fe46963e251d3fb29c4c		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x9997 18640 bytes
font_00_sfnt_off00006525.bin
4c3bade0afb89e87c5d23ec3c4c2a4313cae5dbff89354da9b5c08cf2089e2c0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6525 5212 bytes
font_01_sfnt_off000076ee.bin
e311a60a6f1368f1931be3586a791132e763b2fa292a40edf9180c3f4545574e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x76EE 10076 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.