Malicious PDF — malware analysis report

Static analysis result for SHA-256 996a8d219b8eada5…

MALICIOUS

PDF

36.1 KB Created: 2020-08-29 20:59:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 02cfcbdcfdfc660d84de0f1ed351dbaa SHA-1: 812ac16d2492710dac67d872d3bfcb9355702007 SHA-256: 996a8d219b8eada5966d468cf4ff073ed355467a1fc8d173681da14ed58c6038
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF was flagged as malicious due to a link to a known redirector (ttraff.ru) and a large number of embedded links, suggesting a link farm or phishing attempt. The document body contains garbled text but also includes the URL 'https://ttraff.ru/wix?keyword=pure+18+pic', reinforcing the heuristic findings. The embedded links likely serve to obscure the malicious destination or to distribute traffic.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=pure+18+pic
    • https://static.usrfiles.com/ugd/a76634_91d9f8c99a254da98580235e9a0683b5.pdf
    • https://static.usrfiles.com/ugd/b8c837_50317b7ffffb444385c759f666e40a19.pdf
    • https://static.usrfiles.com/ugd/b8c837_8721ec39ed8242659ef8b3856c7e077f.pdf
    • https://static.usrfiles.com/ugd/b8c837_a292157288c34cb6a8fde7ba316f5abb.pdf
    • https://static.usrfiles.com/ugd/b8c837_dcda7f008e8440789679917b9cda487e.pdf
    • https://static.usrfiles.com/ugd/b8c837_db409db4f6a241769f915350bc4ae4e7.pdf
    • https://static.usrfiles.com/ugd/b8c837_500b4c203a30405fa7e34697817d959c.pdf
    • https://static.usrfiles.com/ugd/b8c837_b6e58425420a424886fa6e7d8e2336de.pdf
    • https://cdn.shopify.com/s/files/1/0440/3894/6981/files/nokajujusekopumatuganopa.pdf
    • https://cdn.shopify.com/s/files/1/0431/5031/1581/files/psat_nmsqt_practice_test_2_answer_key.pdf
    • https://cdn.shopify.com/s/files/1/0431/8239/1451/files/20475696767.pdf
    • https://cdn.shopify.com/s/files/1/0431/9212/3553/files/que_es_un_trauma_psicologico.pdf
    • https://cdn.shopify.com/s/files/1/0434/5479/1846/files/47508042253.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004505.bin
0cf6dfa7cb75e71e6dd0f5003c9fec7ce9af99d5cf3bc0ba2222c8ad0bf6c4aa		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4505 4340 bytes
font_01_sfnt_off000053d4.bin
663ed354f46c9795624fab49940b488ad3b755906e3d7bb71e974a1db1cee656		 pdf-font-stream PDF embedded font (sfnt) at offset 0x53D4 10144 bytes
font_02_sfnt_off00007602.bin
b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7602 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.