Malicious PDF — malware analysis report

Static analysis result for SHA-256 979737c482840efb…

MALICIOUS

PDF

33.8 KB Created: 2020-08-31 15:24:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e3e0d2bcb154a4270a1896feb47e1aaf SHA-1: b109d234acd27fd3c9fb6152e4b753bfeeb909c7 SHA-256: 979737c482840efbb69151a965ced9f1f3519175d87835744639578c2b1cc577
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a malicious redirector link, identified by the heuristic PDF_MALICIOUS_REDIRECTOR_LINK, which points to 'https://ttraff.cc/wix?keyword=10th+class+science+notes+in+marathi+pdf'. The document also features a link farm with numerous external PDF links, as indicated by PDF_SEO_LINK_FARM. The ML classifier strongly flagged this PDF as malicious. The primary attack vector appears to be social engineering through a deceptive document, aiming to trick users into clicking the malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=10th+class+science+notes+in+marathi+pdf
    • https://static.usrfiles.com/ugd/b8c837_7bcc7ed12d6f4e20a27e744070c3c711.pdf
    • https://static.usrfiles.com/ugd/c0b427_add7bbf60a7749cf8bb26650138fca9e.pdf
    • https://static.usrfiles.com/ugd/33a16d_3806040fbc0c4e708c6ae9cbf388ffd5.pdf
    • https://static.usrfiles.com/ugd/b8c837_34bfc55053e041deb60ee9458944597e.pdf
    • https://cdn.shopify.com/s/files/1/0459/9385/3087/files/coulomb_s_constant_k.pdf
    • https://cdn.shopify.com/s/files/1/0427/9074/8316/files/diccionario_sinonimos_y_antonimos_en_ingles.pdf
    • https://cdn.shopify.com/s/files/1/0437/6202/4605/files/84282788417.pdf
    • https://cdn.shopify.com/s/files/1/0429/7208/6423/files/anatomy_and_physiology_for_nursing_and_healthcare_professionals.pdf
    • https://static.usrfiles.com/ugd/c63dba_859f786288d74e8aa632565807708edb.pdf
    • https://static.usrfiles.com/ugd/b8c837_cd6d533450d94305a5d7c879a0ccb919.pdf
    • https://static.usrfiles.com/ugd/b8c837_ec31714a27b74abebb7d7c62c86ad74a.pdf
    • https://static.usrfiles.com/ugd/c162b3_7f1a1d9898264ce2bf9081c8da5ef63b.pdf
    • https://static.usrfiles.com/ugd/2e4eb4_32d03a13f78e477fbac19bf05d64b402.pdf
    • https://static.usrfiles.com/ugd/ee4a13_5a61c52bed5241b6aa82ba1b21c68a08.pdf
    • https://static.usrfiles.com/ugd/74e905_156466fbd2ff4a759ecbf011ba3342c1.pdf
    • https://static.usrfiles.com/ugd/934fc3_46f6e85ee9794209ad913ab7e34e76e1.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000047ee.bin
6858ad4857d706110b0e806dd8fe819e69d870c2dfa46cf6f478c004dc441fa6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x47EE 5492 bytes
font_01_sfnt_off00005a6f.bin
b0cd5823a98540f99a1d872ec9b2952eea4d21de9c8bffffc878341c4dcf7770		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5A6F 9364 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.