Malicious PDF — malware analysis report

Static analysis result for SHA-256 55b4e83ac528df39…

MALICIOUS

PDF

56.9 KB Created: 2020-08-30 21:40:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: af423c4d576d20bb75b232752a5763fd SHA-1: 3d71da739eaec7a06f770c9c3a05c69b30396a1e SHA-256: 55b4e83ac528df39bce152d265d8f72f632baa11008e47ca70cc3c1d50a27586
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by multiple critical heuristics for containing a malicious redirector link and a large number of external PDF links, indicating a link farm. The primary malicious URL identified is https://ttraff.cc/wix?keyword=violet+evergarden+episode+14, which is likely used to lure victims. The document body contains garbled text but also repeats the malicious URL, reinforcing its presence.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=violet+evergarden+episode+14
    • https://static.usrfiles.com/ugd/ad2ade_5baf1fcf7e20445fafcafeb09f77ef4c.pdf
    • https://static.usrfiles.com/ugd/5ad03d_dad2c650a6254536be09d51290a73a15.pdf
    • https://static.usrfiles.com/ugd/b77b08_a904bf9fdb6d4b72aecd40d8cadffd02.pdf
    • https://static.usrfiles.com/ugd/b8c837_7f9a4365e1224fc896f2ac8074c61f03.pdf
    • https://static.usrfiles.com/ugd/24853a_6999b85493a847d4b66a54eaeaa0a4c0.pdf
    • https://static.usrfiles.com/ugd/07ef24_3bf79adfeb6440faab294d227d29179e.pdf
    • https://static.usrfiles.com/ugd/07ef24_b1389fbe9f564119a825ddc2dac8ed91.pdf
    • https://static.usrfiles.com/ugd/b8c837_f07c65a23bd341119e646d37fcfb6133.pdf
    • https://static.usrfiles.com/ugd/b8c837_514fcb85c753499db8ea586f9985d5a2.pdf
    • https://static.usrfiles.com/ugd/b8c837_b5a9a028e0b644cd8d98e93a5652333a.pdf
    • https://static.usrfiles.com/ugd/b6edda_a36c1df59e1a426b99b294885b8f4fee.pdf
    • https://static.usrfiles.com/ugd/913720_2438dd41de424c3d8078dad0c071cbf7.pdf
    • https://static.usrfiles.com/ugd/b8c837_cb47b5f1d4014dbdb96ac6e2fda0fb45.pdf
    • https://static.usrfiles.com/ugd/b8c837_b0aabbc553d042b99877955f06c725cc.pdf
    • https://static.usrfiles.com/ugd/7c3584_c8afe9844ccf4bf39e934b67169db145.pdf
    • https://static.usrfiles.com/ugd/b8c837_344215e993c5403eb9505e7d16cfb44e.pdf
    • https://static.usrfiles.com/ugd/4b7290_0c9c1bd2a23848f987bcf575037405bb.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000064ee.bin
1e51926652bcd90049218c214d364a7123d6551c8cfe7568e1062b03439b46a3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x64EE 6388 bytes
font_01_sfnt_off00007ad1.bin
8ccb0f0ce828b881442bce879f6b0f39863ed62e0261d5e6b64d3bd4b5d0f3d1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7AD1 5080 bytes
font_02_sfnt_off00008c2a.bin
e377eeb67b82367040cef8db5787701e8bd22ece57c29ff2b91b60fc48d8a403		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8C2A 7004 bytes
font_03_sfnt_off00009eb0.bin
5671163ed089a056f9dd473a1d77c51b024bbca0a7abe8b63904699dc7ca83af		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9EB0 12836 bytes
font_04_sfnt_off0000c7c1.bin
ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC7C1 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.