Malicious PDF — malware analysis report

Static analysis result for SHA-256 6e99df34c10e2553…

MALICIOUS

PDF

46.6 KB Created: 2020-08-05 12:46:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8757c5d742df7752aab4826f2fddf0ba SHA-1: 8623ca8f09f1b0c876f2c4f86101cdac47e3977c SHA-256: 6e99df34c10e2553ee2fdafb0ef97e8d66f4c942b7b0bd3973de1d2c94520d56
214 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document contains a critical heuristic firing for a malicious redirector link, directing to 'https://ttraff.ru/pify?keyword=afcat+ekt+syllabus+for+computer+science+pdf'. The document body also contains this URL, and the document is designed to trick users into revealing recovery secrets or private keys. The presence of numerous embedded links, many pointing to benign Shopify domains, suggests a link farm SEO tactic to obscure the malicious redirector.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Recovery secret / private key request critical SE_SECRET_RECOVERY_LURE
    Document requests recovery phrases, private keys, backup codes, or saved passwords. Requests for these secrets in a document are high-risk.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=afcat+ekt+syllabus+for+computer+science+pdf
    • http://files.agricolacuvelier.com/uploads/1/3/1/1/131163957/zolimame-wazefe-tasazirenas.pdf
    • http://files.alamaccounting.com/uploads/1/3/1/8/131856186/xobiba_xazejumevage_xitedamalo.pdf
    • http://files.pagetalbott.com/uploads/1/3/1/6/131607053/fbede254a6cad2a.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fedorahosted.org/lohit
    • https://cdn.shopify.com/s/files/1/0437/8640/4000/files/91525404493.pdf
    • https://cdn.shopify.com/s/files/1/0435/1157/8776/files/82919154793.pdf
    • https://cdn.shopify.com/s/files/1/0431/0633/6930/files/25777561561.pdf
    • https://cdn.shopify.com/s/files/1/0430/7802/5377/files/15915119070.pdf
    • https://cdn.shopify.com/s/files/1/0429/4397/1484/files/cash_luna_books.pdf
    • https://cdn.shopify.com/s/files/1/0437/5894/4405/files/wexafola.pdf
    • https://cdn.shopify.com/s/files/1/0427/8494/8380/files/vogerotaregexiluvigose.pdf
    • https://cdn.shopify.com/s/files/1/0427/6633/6167/files/pafuverima.pdf
    • https://cdn.shopify.com/s/files/1/0432/3724/5086/files/nozukeliwaxevimupidanis.pdf
    • https://cdn.shopify.com/s/files/1/0434/4466/6529/files/73436100769.pdf
    • https://cdn.shopify.com/s/files/1/0433/3925/1870/files/90084976251.pdf
    • https://cdn.shopify.com/s/files/1/0430/8759/3632/files/shadowrun_4e.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006c59.bin
f685e4306033b5bd1cd1fa080f767d43c0a9a6fa4aa49f90307b729662952c43		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6C59 5596 bytes
font_01_sfnt_off00007f58.bin
b95908cb826829c53454477e7dea1030f564b3ee3003987956d58fa60bda56c6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7F58 9956 bytes
font_02_sfnt_off0000a194.bin
a12908a88df35a7e9eb57470e9a94a806bb52df392ce88a62d07cba2b79b9044		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA194 2832 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.