PDF malware analysis — malicious · ac0881bbf5bd1aa5

MALICIOUS

PDF

65.2 KB Created: 2020-09-01 10:51:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 338f05c1ebad682b354c25d60e897acb SHA-1: 56cdec78cb5dbd4bedb75915fdfed1557055bdf3 SHA-256: ac0881bbf5bd1aa51267d71720d60ea47d4cbcfbb3132759e281f0fd21ead333

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a link farm and a critical heuristic firing for a malicious redirector. The embedded URL, 'https://ttraff.cc/wix?keyword=skeletal+system+anatomy+of+a+bone+worksheet', is the primary indicator of malicious intent. This suggests the document is designed to trick users into visiting a malicious website, likely for phishing or malware distribution.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=skeletal+system+anatomy+of+a+bone+worksheet
- https://static.usrfiles.com/ugd/7c3584_e5bad66c34ca48e682f745c2fe524996.pdf
- https://static.usrfiles.com/ugd/c1de29_6252b55d076f46c9881deda7e441e0c7.pdf
- https://static.usrfiles.com/ugd/4d400c_8bcde3dc1d1f4e1f9ce14d90462281ed.pdf
- https://cdn.shopify.com/s/files/1/0435/6915/2159/files/kedagewivuw.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/gokibaleginasesomedusuj.pdf
- https://cdn.shopify.com/s/files/1/0431/5129/4619/files/kingdom_animalia_phylums.pdf
- https://cdn.shopify.com/s/files/1/0431/4926/3004/files/99922390130.pdf
- https://static.usrfiles.com/ugd/0dd040_0fc5a510379d4884aae040273c577332.pdf
- https://static.usrfiles.com/ugd/6c032c_f3a9960db30d4a8d800587e4758de4fd.pdf
- https://static.usrfiles.com/ugd/278743_9cf4627182544273b96f1e9923c51afd.pdf
- https://static.usrfiles.com/ugd/0c41e7_3f0d2793adb242e8b2796a8d14df50c8.pdf
- https://static.usrfiles.com/ugd/b8c837_e11e319da3e944ceb21665370faddd39.pdf
- https://static.usrfiles.com/ugd/b8c837_19f89640d3bb44aea2a338c217176e68.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000c239.bin` `cdd6190bdd67821ffb11876f18ebd358a0d2b651cda98e15a010b7934ebb9ed1`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC239	5508 bytes
`font_01_sfnt_off0000d4e4.bin` `5b594dc8ce275d0ec6b07717d9711bad1c6908dfcde72522b4af5482582c319f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD4E4	10144 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.