Malicious PDF — malware analysis report

Static analysis result for SHA-256 b097897eb630dcbb…

MALICIOUS

PDF

47.3 KB Created: 2020-09-18 15:35:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2cc71e38e790debdaa95c04f1dc2ae95 SHA-1: d10b29d338d54980c64d3faacb6fd4fe52baca19 SHA-256: b097897eb630dcbb4211a0f366b85a58b9584a71c9530083db1a563e60b69e27
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a high number of embedded links, many of which point to a redirector service. The primary malicious URL, 'https://ttraff.club/pify?keyword=cfa+level+1+notes+pdf+download+free', is designed to lure users into downloading potentially harmful content by offering 'free notes'. The ML classifier strongly supports the malicious nature of this PDF.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/pify?keyword=cfa+level+1+notes+pdf+download+free
    • https://17c8ce45-9a27-4b4d-a044-
    • https://d436c2b0-2213-4faf-91b5-cb7ce5c6d78a.filesusr.com/ugd/03dcd4_5e270d76c4184fdb8d30e29a1d512811.pdf?index=true
    • https://842e713b-f029-4363-b20e-8116d05ccbe9.filesusr.com/ugd/5926b4_90656680867e457f8194507c4266af73.pdf?index=true
    • https://426c0614-c600-4782-9f96-25da24244f89.filesusr.com/ugd/417718_6389997c7d234dbc928976eee10eeaf3.pdf?index=true
    • https://314f486e-dd3b-4ee1-afa7-f86612257c2b.filesusr.com/ugd/5f4192_b454651e9042469aa6e5a298b337b58e.pdf?index=true
    • https://0dd67634-b1c7-4ae9-9230-6137982fabb0.filesusr.com/ugd/205ae4_1dd6f93c8879467babaf48f88a999c0d.pdf?index=true
    • https://aa33cf94-0855-4ed7-93be-fbfdfd66a9ef.filesusr.com/ugd/cf5aa9_215562771e514b39be1a35b396439bf9.pdf?index=true
    • https://4f92b016-8114-45d7-8fb9-4bc882dc5e5b.filesusr.com/ugd/05301a_2a1ec35fed4444bba249c269d191f8d9.pdf?index=true
    • https://7ef46397-3289-455f-8f70-cb818036c861.filesusr.com/ugd/9ec29b_32a1e47228344f93894fa46b01d66a1e.pdf?index=true
    • https://7039d030-afcf-4218-89bc-930ee63b10f3.filesusr.com/ugd/61b8bf_f3848b3823df4663a951c989ec332ab0.pdf?index=true
    • https://61c82c0d-7d88-45c5-8489-34bc128e65c3.filesusr.com/ugd/1b0481_4de32693909e4801a972b821ba079dbb.pdf?index=true
    • https://eb431af2-0e23-46b8-abd0-bd532759becf.filesusr.com/ugd/1d64af_0625dd0970e446e88a93ee337e2e2704.pdf?index=true
    • https://2ec5a2bc-1ea4-42d2-88a0-5a5d8edae2c2.filesusr.com/ugd/07625c_cb6b274c3022483f87e3829b9a7e1130.pdf?index=true
    • https://1c886b96-6735-4ad1-880d-67a1ae1aad40.filesusr.com/ugd/d902bb_b6a5b8e9b24143328b26e32b9b9ca987.pdf?index=true
    • https://d6a58d65-39fd-4d9c-bf62-0f7f635b9db5.filesusr.com/ugd/f84671_cc9a3a399e43459b82905649991b72ef.pdf?index=true
    • https://81542f7a-3091-4b22-bfd0-f81c8ef6b2b4.filesusr.com/ugd/61804c_a72cd2ddd97b4e7e833df2df1b9339a9.pdf?index=true
    • https://17c8ce45-9a27-4b4d-a044-20922550aa2d.filesusr.com/ugd/8ff694_b001304ff4ec405aafe09b7d24ea5895.pdf?index=true
    • https://a4b9c6fa-8c45-429d-b361-93f5774d67f1.filesusr.com/ugd/5b1e3c_7749b996fb154e0da55ba4a89239c1b1.pdf?index=true
    • https://c4fd2dbc-d125-42af-9b94-ae9ba9365d8f.filesusr.com/ugd/c83fdb_702b0d098d174bdc92c0ce7a53811e5e.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006a35.bin
ebc010903c2630007d1f6e5235a3478bef1e2ecd64306c37ee6056bc65fdbe2c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6A35 5000 bytes
font_01_sfnt_off00007b6a.bin
b7a54931452c97b45a3b5a38ba3deea74355c8c7efe66f73b1f5f391b732c0af		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7B6A 10860 bytes
font_02_sfnt_off0000a051.bin
0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA051 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.