Malicious PDF — malware analysis report

Static analysis result for SHA-256 82583ebfe3a90c7f…

MALICIOUS

PDF

53.3 KB Created: 2020-09-04 21:57:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 29fe39d653114ce078473519702d6a4a SHA-1: 5808854e29ca0da54e9e2d5328ed709766ae4c56 SHA-256: 82583ebfe3a90c7f2866124291777ac58bf11beb3aa6528d9068207dabeb7577
162 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.club/pify?keyword=alcohol+phenol+and+ether+notes+pdf'. Additionally, it features a large number of external PDF links, suggesting a link farm or redirection scheme. The ML classifier also strongly flagged this PDF as malicious. While no scripts were extracted, the presence of embedded URLs and the redirector link indicate a likely phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/pify?keyword=alcohol+phenol+and+ether+notes+pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://static.usrfiles.com/ugd/d8e941_085267af97e54c61868aed18a3bbc649.pdf
    • https://static.usrfiles.com/ugd/b8c837_869ea1663a48477aac062d4ac3bcb323.pdf
    • https://static.usrfiles.com/ugd/ede58b_5117367e6a36475297727b17fc254292.pdf
    • https://static.usrfiles.com/ugd/33a2e4_0d6fd4e642cb47bb89cd933d0024c2fa.pdf
    • https://static.usrfiles.com/ugd/880a7e_dbf9326c2b0a47b0970788cfb07a7cc3.pdf
    • https://static.usrfiles.com/ugd/b09e1d_56a8a03ddef14221adf8d6a3592507cd.pdf
    • https://static.usrfiles.com/ugd/64d889_fe111cdd53df4a8bbcd76b55569462bf.pdf
    • https://cdn.shopify.com/s/files/1/0427/4031/8375/files/bagelodi.pdf
    • https://cdn.shopify.com/s/files/1/0428/4914/0902/files/28532470970.pdf
    • https://cdn.shopify.com/s/files/1/0431/3609/0269/files/centrosema_pascuorum.pdf
    • https://cdn.shopify.com/s/files/1/0435/9654/6216/files/game_bully_2_pc.pdf
    • https://cdn.shopify.com/s/files/1/0441/3623/5160/files/98854296820.pdf
    • https://cdn.shopify.com/s/files/1/0429/6572/9429/files/bahadur_film_video_songs.pdf
    • https://cdn.shopify.com/s/files/1/0434/7035/6632/files/tipos_de_aprendizaje_visual_auditivo_y_kinestesico.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007f0d.bin
ae63dbc9346183f40d261b992fd330fe1e6d4a5d8aaced85caed4401b86ce8bc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7F0D 5232 bytes
font_01_sfnt_off000090d5.bin
9e49f42329c926af9fbfb55cd0e2fd4e5665e2f6511b4866742d87859f74455c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x90D5 10080 bytes
font_02_sfnt_off0000b369.bin
3da9309f7c28e01a20d15285b754fad9116e6eb7744d168a0fff2950d6122081		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB369 16072 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.