Malicious PDF — malware analysis report

Static analysis result for SHA-256 61b7c6c6a67f0761…

MALICIOUS

PDF

38.9 KB Created: 2020-09-01 13:46:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 68c9a11d993879e8b6f0e9dc476d4e6e SHA-1: 4d23496b51ed437d5ef79cfaeadb0fbfbef86b24 SHA-256: 61b7c6c6a67f0761ba2973ac8db3639f4d1a45e95eea8f8a4e56ea1292b2c657
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains numerous embedded links, many of which point to a link farm designed to distribute SEO spam. One critical heuristic identified a link to a known malicious redirector at 'https://ttraff.ru/pify?keyword=months+of+year+worksheets+ks1'. The ML classifier also strongly indicated maliciousness. The document body, though heavily obfuscated, contains references to educational content and the malicious URL, suggesting a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=months+of+year+worksheets+ks1
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0434/1989/3927/files/madagascar_movie_in_dual_audio.pdf
    • https://cdn.shopify.com/s/files/1/0431/1308/7142/files/3740217912.pdf
    • https://cdn.shopify.com/s/files/1/0433/3089/6026/files/61814143326.pdf
    • https://static.usrfiles.com/ugd/6c98bc_99de132deea9462ba0143886c62d66b1.pdf
    • https://static.usrfiles.com/ugd/6cfc61_f7e5baeb5fd34bb88db028aacba26621.pdf
    • https://static.usrfiles.com/ugd/097bd5_fa06ed249c504da3a8ae3cc538b9d496.pdf
    • https://static.usrfiles.com/ugd/0c4177_004017f4e8ce41af8beaff636f81b6cc.pdf
    • https://static.usrfiles.com/ugd/353d00_d9a5a0bb9faa4d5aa6877ce48e42b109.pdf
    • https://static.usrfiles.com/ugd/5bb01c_a6573a5885bf4cc49d06eb1e71d9a4c3.pdf
    • https://static.usrfiles.com/ugd/b5aed9_8349160dcca745d2af4b32f4205be345.pdf
    • https://static.usrfiles.com/ugd/74a852_c3fff39d707144d4aaef59c600e02a0c.pdf
    • https://static.usrfiles.com/ugd/a474dd_096b3f0766774763b69e3653196f5445.pdf
    • https://static.usrfiles.com/ugd/e5a943_8a325560e31e463183bfe957b2caf673.pdf
    • https://static.usrfiles.com/ugd/2274a7_8b95f6622b0145baba1f2180bbe3556d.pdf
    • https://static.usrfiles.com/ugd/b47706_52a8b6e3c98147fb9fdc50e60455c7cc.pdf
    • https://static.usrfiles.com/ugd/599f1c_2a6d233ad8584199abb69e2ee4b1909f.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000058ce.bin
1711f55834ac827c39e6f8a11f4e226566986ec631b26a592ed0c1e657351886		 pdf-font-stream PDF embedded font (sfnt) at offset 0x58CE 5136 bytes
font_01_sfnt_off00006a6a.bin
02370bf4aad429be352e366b970c1b17ce62d25dace706528980275e96e350c0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6A6A 10912 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.