Malicious PDF — malware analysis report

Static analysis result for SHA-256 5fc82e219654c583…

MALICIOUS

PDF

48.4 KB Created: 2020-08-11 04:50:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8a74dd5d2fe2cb1cc6a0114c3ea3e6c4 SHA-1: affb51a63c203495a4584614275d74ec0f8389f5 SHA-256: 5fc82e219654c58368dd2e438aee72ea24b32d27fe5422aa6a43bbd3df34def9
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links, many of which are designed to appear as legitimate documents but redirect to a known malicious URL. The primary malicious URL identified is ttraff.ru, which is flagged as a redirector. This suggests the document is part of a link farm or SEO poisoning campaign to drive traffic to malicious sites, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=career+opportunities+in+biotechnology+and+drug+development+pdf
    • http://files.fuseplus.com/uploads/1/3/0/8/130813887/pixulafojukefedele.pdf
    • http://files.rivermenrodandgunclub.com/uploads/1/3/2/3/132302973/nomegariwutok-wibiwu-visinatixubuj-sojimuta.pdf
    • http://files.princetondogtrainingclub.com/uploads/1/3/2/6/132695586/5736632.pdf
    • http://files.camelliacharlesjewelry.com/uploads/1/3/1/3/131381288/24c0721.pdf
    • http://files.regalbakeryusa.com/uploads/1/3/0/8/130813992/ginavakada.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0430/5489/1161/files/jolly_roger_bl2.pdf
    • https://cdn.shopify.com/s/files/1/0432/0290/4222/files/powazo.pdf
    • https://cdn.shopify.com/s/files/1/0429/7441/2949/files/mythical_creatures_list_a_z.pdf
    • https://cdn.shopify.com/s/files/1/0436/6978/2693/files/jukifemorebivojejupu.pdf
    • https://cdn.shopify.com/s/files/1/0433/0681/1560/files/risetirowulikaketevot.pdf
    • https://cdn.shopify.com/s/files/1/0429/3958/0575/files/83970219920.pdf
    • https://cdn.shopify.com/s/files/1/0431/7102/0957/files/sefunawa.pdf
    • https://cdn.shopify.com/s/files/1/0433/9413/8268/files/annotated_bibliography_apa_example.pdf
    • https://cdn.shopify.com/s/files/1/0437/8610/9086/files/15836032149.pdf
    • https://cdn.shopify.com/s/files/1/0428/5438/3782/files/fipevinuxusozusilutu.pdf
    • https://cdn.shopify.com/s/files/1/0428/4963/2412/files/fapovalonilogabusotix.pdf
    • https://cdn.shopify.com/s/files/1/0435/3844/8548/files/nijil.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006669.bin
cf32ecf613ce711228bc5915ed05267628426cb168dc8de03f4b36cd021c88f0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6669 5776 bytes
font_01_sfnt_off000079ef.bin
00104b92535cd678a6ed9ea43c4b73b03e2af446784d2a937a78d8c65dedaea9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x79EF 10924 bytes
font_02_sfnt_off00009f63.bin
d7dbcefd5a9d087f9dbd48d87e5b82950a900fa0f666d4a1f78598b818f3f613		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9F63 16060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.