Malicious PDF — malware analysis report

Static analysis result for SHA-256 ad06054179a41695…

MALICIOUS

PDF

52.0 KB Created: 2020-08-31 23:33:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e9573959e7ca17c9960fa8364ecf87f0 SHA-1: 70b1bace11971a6e6205c26819fc972022effc5d SHA-256: ad06054179a4169570b0add9c5d8dc6a8a5446bbefb6ad7c94f60a5a1237922f
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a critical heuristic firing for a malicious redirector link, pointing to 'ttraff.com'. The document body, though heavily obfuscated, also contains this URL, suggesting it's the primary lure. The file is also flagged by a machine learning classifier as malicious. No scripts were extracted, and the PDF structure itself does not indicate specific exploit techniques beyond the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=pa+cosmetology+state+board+study+guide
    • https://static.usrfiles.com/ugd/2f8cea_3ceb57cce38c4808861b7ae9fcddc6d2.pdf
    • https://static.usrfiles.com/ugd/ea78e0_c189f37d40964149baa032bb01218c26.pdf
    • https://static.usrfiles.com/ugd/b8c837_dfc9e532df724280a6d602c5f11ca9ee.pdf
    • https://cdn.shopify.com/s/files/1/0459/9247/6834/files/beginner_gym_workout_routine_female.pdf
    • https://cdn.shopify.com/s/files/1/0434/5679/0695/files/97601879124.pdf
    • https://cdn.shopify.com/s/files/1/0433/6248/4383/files/main_badhiya_song_free.pdf
    • https://cdn.shopify.com/s/files/1/0436/6044/3813/files/mathematics_for_economists_by_taro_yamane.pdf
    • https://cdn.shopify.com/s/files/1/0441/2217/7688/files/carbohydrates_notes_download.pdf
    • https://cdn.shopify.com/s/files/1/0459/6288/7335/files/7th_grade_math_word_problems_worksheets.pdf
    • https://cdn.shopify.com/s/files/1/0431/4297/1553/files/severusugebekanot.pdf
    • https://cdn.shopify.com/s/files/1/0463/6396/7643/files/short_love_letter_for_girlfriend.pdf
    • https://cdn.shopify.com/s/files/1/0437/4695/1319/files/the_duck_song_lyrics.pdf
    • https://cdn.shopify.com/s/files/1/0429/6625/3724/files/tatkal_ticket_booking_form.pdf
    • https://cdn.shopify.com/s/files/1/0435/7960/5147/files/hepatitis_c_testing_guidelines_canada.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006833.bin
e36190b6155d2202e22ace12e14ca73090377413fa9ed3fa62ca0911ed182d10		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6833 5504 bytes
font_01_sfnt_off00007acc.bin
0c5b73d1d75d8fddad5b402a5d220e3ed607ab7923131696503e3a8c4c779682		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7ACC 2392 bytes
font_02_sfnt_off0000853d.bin
cf7deb4661b4b331ff46ff38ae77221deb386d7050034b7e8c8ec399db31bc99		 pdf-font-stream PDF embedded font (sfnt) at offset 0x853D 10376 bytes
font_03_sfnt_off0000a900.bin
a808c85f48dc6e45f5b282183b6fde0ffd638772d028fc199a0d054fb841320e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA900 16932 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.