Malicious PDF — malware analysis report

Static analysis result for SHA-256 a599a6f74c0478ff…

MALICIOUS

PDF

54.8 KB Created: 2020-09-17 03:42:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: af4f5558553165925fe3da9e025ccdee SHA-1: 7853ac0ea00f1cd2a5e90683bf28ecbd2e7f2dc2 SHA-256: a599a6f74c0478ff2c0115069af1380c5de8adbd6c4fc6f6e42b6c0238c1d877
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged by multiple critical heuristics, including PDF_MALICIOUS_REDIRECTOR_LINK and PDF_SEO_LINK_FARM, indicating it contains numerous links to potentially malicious or redirector infrastructure. The primary malicious URL identified is https://ttraff.club/wix?keyword=memes+roman+reigns. The document body contains garbled text and metadata suggesting it was generated by wkhtmltopdf, and the embedded links are likely designed to lead users to phishing or malware distribution sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/wix?keyword=memes+roman+reigns
    • https://e928e497-4afe-4b6e-a32b-f0a8a728b5e1.filesusr.com/ugd/e3c460_4922327e1b4d475db9e7db7878f4dd7f.pdf?index=true
    • https://bca75109-07ac-4b50-9f7c-8c24a53178e9.filesusr.com/ugd/d31907_849973f8c6fc461f9a2849eb8494e56c.pdf?index=true
    • https://39d2ad48-5a2b-4ad6-9107-a7ffae88cd2c.filesusr.com/ugd/1cfe37_3c95d5b9b01d43d6840d4c161bbed7f1.pdf?index=true
    • https://5338970b-5336-4ba8-bd46-02ef17b81e89.filesusr.com/ugd/f2c1dc_885d0ac364f34a2680114043e4dd688f.pdf?index=true
    • https://f8a5f121-977f-4482-a048-51335f9cd9e5.filesusr.com/ugd/b4a829_8f5415ab84e44c719c8ad372b67aaf6d.pdf?index=true
    • https://cdn.shopify.com/s/files/1/0431/1397/1861/files/javascript_random_integer.pdf
    • https://cdn.shopify.com/s/files/1/0437/3685/8776/files/9583257488.pdf
    • https://cdn.shopify.com/s/files/1/0434/1320/9246/files/diduniwizu.pdf
    • https://cdn.shopify.com/s/files/1/0431/9127/1586/files/65656074270.pdf
    • https://cdn.shopify.com/s/files/1/0481/8518/0327/files/6074575726.pdf
    • https://e8e4d050-3425-4248-8c50-971e2d43af28.filesusr.com/ugd/80fd5d_a8861811091c46a08ddf5c9fb94801b2.pdf?index=true
    • https://61961511-8bb5-4e52-ac03-69afd417d23e.filesusr.com/ugd/5899d5_7892edfa987f49afb6765cb494e55c11.pdf?index=true
    • https://9899c0e7-c9c4-4ba4-bb6e-a47b82b87db8.filesusr.com/ugd/0f5b72_ff588579cf2b417383b87c1b94e651a2.pdf?index=true
    • https://b2835ffa-87fe-467b-9ce7-3282c96ff72d.filesusr.com/ugd/87b9a8_4fe5a301e9a64f1292c847e974f5cd4c.pdf?index=true
    • https://5377fea6-3e6e-4013-bda8-cd5694a9cdd1.filesusr.com/ugd/a86d68_4fcd5fc02d344240bc09ae62843d521f.pdf?index=true
    • https://cdn.shopify.com/s/files/1/0432/1561/8203/files/tosaxijowi.pdf
    • https://cdn.shopify.com/s/files/1/0432/7066/8453/files/solemifekukofemutidutato.pdf
    • https://cdn.shopify.com/s/files/1/0430/5040/1943/files/anesthesia_textbook_free_download.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://cdn.shopify.com/s/fil

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00009946.bin
b58c203e122913b6b1dda83b873f65241858b12edea707f612161739f34c4cc5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9946 4976 bytes
font_01_sfnt_off0000aa28.bin
127fc7bd879a9993ca7b8a57643b3f36a4c5b42f05c11e7e598a9da480701fae		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAA28 10176 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.