Malicious PDF — malware analysis report

Static analysis result for SHA-256 81cfb6bd93d292cc…

MALICIOUS

PDF

34.7 KB Created: 2020-09-17 05:59:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 02a891f98bc3649c908146eb95069957 SHA-1: b6ba9bc391a9ece66613c14791236983ae021353 SHA-256: 81cfb6bd93d292cc67caf07abfd8334acba98578676c541919502e27bf1dcb1b
184 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links, many pointing to disposable domains, indicating a link farm designed to distribute malicious content or phish users. The primary redirector link, https://ttraff.link/wix?keyword=parts+of+a+circle+worksheet+tes, is a strong indicator of malicious intent. The ML classifier also flagged this PDF with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/wix?keyword=parts+of+a+circle+worksheet+tes
    • http://files.legacysportsphx.com/uploads/1/3/0/8/130814717/2d179fc6e6.pdf
    • http://files.deepdabarberonline.com/uploads/1/3/2/7/132710601/4085536.pdf
    • http://files.jennifergrayphd.com/uploads/1/3/0/7/130775897/sewuzugizo.pdf
    • http://gopiguri.novelideasbylaura.com/uploads/1/3/0/8/130873951/siselatijin.pdf
    • http://nokoguket.christismysaviorministries.org/uploads/1/3/1/6/131606457/5728673.pdf
    • http://bodet.medfordwindowcompany.com/uploads/1/3/1/4/131452942/jixawazene.pdf
    • http://files.robynstarfield.com/uploads/1/3/1/1/131164431/xejanusoxaminagir.pdf
    • http://mefizob.jackandjillraleigh.org/uploads/1/3/1/3/131381839/ludawejorosafixol.pdf
    • http://files.olivialevez.com/uploads/1/3/2/6/132695492/ritat.pdf
    • http://bidupovav.imageconsultantphilippines.com/uploads/1/3/1/4/131452922/7704237.pdf
    • http://files.strolloxcommunityoutreach.com/uploads/1/3/1/3/131384229/gusibilobon_gowiterajiwa_kajiwe_tokakigigoka.pdf
    • http://fufagugu.sorcerersatchel.com/uploads/1/3/1/8/131859261/1233302.pdf
    • http://files.coredynamics.com.au/uploads/1/3/1/3/131383681/mefeso.pdf
    • http://sebifir.sfsafehouse.org/uploads/1/3/0/8/130814328/6560125.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://ec5bf4d5-58b5-476b-baea-8ef451ef1564.filesusr.com/ugd/062c90_7dd9324310d14b168083726af1325155.pdf?index=true
    • https://1d60dd49-405f-4a62-a7fa-2d361515eafc.filesusr.com/ugd/140efa_48abf737ece3402abf8d1a7b7223e854.pdf?index=true
    • https://2f755011-5c99-4110-a60e-1865b21c4576.filesusr.com/ugd/158fb9_ba0e8a873f994c61a03799b8ebd7cea1.pdf?index=true
    • https://fa8e347e-6a7b-4482-bef2-f2b3127bc813.filesusr.com/ugd/2c7c49_4541e93a61a64c7f989787fc323995a3.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004ad8.bin
c1d6fd41536f6d49b9c8baebf334f988d688f5ea24fa420a17e503bccc567b09		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4AD8 5124 bytes
font_01_sfnt_off00005c55.bin
3b1a287f6f898ad68c38d838a75b718ee983130db96bae1bdcf496f764841f4e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5C55 9828 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.