Malicious PDF — malware analysis report

Static analysis result for SHA-256 91f841aca06aeccb…

MALICIOUS

PDF

44.0 KB Created: 2020-09-06 18:51:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 96b8ef41c27f25cb171fcd4f928d6768 SHA-1: 03e0be122880f3de7000f85eece662f102a7761c SHA-256: 91f841aca06aeccbed260d3f5fa07c59fcc7d998b426cde0a8215909b7be4cea
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a malicious redirector link disguised as a resource for 'adirondack chair templates and plan'. This link, ttraff.me, is flagged as malicious and likely leads to a phishing or malware distribution site. The PDF also exhibits characteristics of a link farm, with numerous embedded URLs pointing to external documents, suggesting a broader campaign to distribute malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=adirondack+chair+templates+and+plan
    • https://static.usrfiles.com/ugd/b8c837_d22cdb9f5e104815a60ba5cfedbbd167.pdf
    • https://static.usrfiles.com/ugd/b8c837_304c82db875343c7814cc21b1dfc30bc.pdf
    • https://static.usrfiles.com/ugd/1cc777_27021b04fbdb4b7484b25345e2e93503.pdf
    • https://static.usrfiles.com/ugd/64bd79_3ce7cebe30104ff992717f33d1dd8d9d.pdf
    • https://static.usrfiles.com/ugd/0bcf16_a2eba33770a54683b631dfd6d2300f16.pdf
    • https://static.usrfiles.com/ugd/48f461_046bbc1e8c7c4888867ca81f7b9bf4cc.pdf
    • https://static.usrfiles.com/ugd/90423f_e5e25e8fefce4055a631da8b09660e97.pdf
    • https://cdn.shopify.com/s/files/1/0431/0679/5686/files/letting_go_of_control_worksheets.pdf
    • https://cdn.shopify.com/s/files/1/0432/7338/8190/files/tovabipatuwowexirebagen.pdf
    • https://cdn.shopify.com/s/files/1/0434/7723/7920/files/captive_prince_short_stories.pdf
    • https://cdn.shopify.com/s/files/1/0437/0841/6165/files/15044928842.pdf
    • https://cdn.shopify.com/s/files/1/0434/8660/9573/files/buretotokogabaditez.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006d97.bin
5fe93fc84a64f0ba055e84e522786c45d2e55b9d734a7102de81a248db809c2d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6D97 5368 bytes
font_01_sfnt_off00007fa8.bin
ad814280fdc0d2747b38d2e735b137f6387a9738672f9bd7a0b8f90ce742a7b1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7FA8 10468 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.