Malicious PDF — malware analysis report

Static analysis result for SHA-256 bd913b31e187e905…

MALICIOUS

PDF

61.9 KB Created: 2020-08-31 13:27:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fa601cf451ec40c1a0217758c37f5053 SHA-1: fe00549eec17a6680a869a386fbeabfbcff7046a SHA-256: bd913b31e187e90525ed7afb513bb643d833200221a83b05e392328832bbec24
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a significant number of embedded links, with a critical heuristic firing indicating a link farm pointing to a malicious redirector. The primary URL, 'https://ttraff.com/wix?keyword=georgia+driving+permit+test+study+guide', is flagged as a malicious redirector. The document body, though heavily obfuscated, contains this URL and other Shopify-hosted PDF links, suggesting a lure to drive traffic to malicious infrastructure. No scripts were extracted, limiting the analysis of direct payload delivery mechanisms.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=georgia+driving+permit+test+study+guide
    • https://cdn.shopify.com/s/files/1/0428/0742/7238/files/87117024145.pdf
    • https://cdn.shopify.com/s/files/1/0452/4769/2957/files/examples_of_endospore_forming_bacteria.pdf
    • https://cdn.shopify.com/s/files/1/0440/8419/9574/files/atkins_chemical_principles.pdf
    • https://cdn.shopify.com/s/files/1/0465/3770/3574/files/dnd_5e_warlock_guide_raven_queen.pdf
    • https://cdn.shopify.com/s/files/1/0431/0935/1578/files/zubojobam.pdf
    • https://static.usrfiles.com/ugd/b8c837_e26cb02dabca4e318de8f915af2fbb92.pdf
    • https://static.usrfiles.com/ugd/b8c837_6c78fa3d490242d9ad021d81dccf3c52.pdf
    • https://static.usrfiles.com/ugd/09273f_539ccfdddf4a4de2a8f73d4c26d1a4af.pdf
    • https://static.usrfiles.com/ugd/b8c837_5e363015ff504085a3de576f5df0ec33.pdf
    • https://static.usrfiles.com/ugd/b8c837_ddc3de42ec984e7496b19d02b39bc019.pdf
    • https://static.usrfiles.com/ugd/b8c837_c7453fe166aa421cb9a6576793c7d090.pdf
    • https://static.usrfiles.com/ugd/b8c837_5a2b4f95692f4b54b6e802b59bb32fc5.pdf
    • https://static.usrfiles.com/ugd/11f207_a9d77090816246f1bb16006b75a40539.pdf
    • https://static.usrfiles.com/ugd/4cf28d_4597543d22414b39ae3f4fc85fbb248f.pdf
    • https://static.usrfiles.com/ugd/b8c837_c6c592f91fdb4e12b5df3134c75d12c1.pdf
    • https://static.usrfiles.com/ugd/822ecd_808cde13ed4a45e2bdab43b1607c2d18.pdf
    • https://static.usrfiles.com/ugd/b0b521_46a55c677909404ab48a73e79c6797aa.pdf
    • https://static.usrfiles.com/ugd/b8c837_5e91c8ffad224240b9b6ae6b2fc36491.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b2ca.bin
c8ea6b8e2994581e63014f137ad33576712068df056bdce300e6ce76ec443a32		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB2CA 5440 bytes
font_01_sfnt_off0000c548.bin
8f620bc81fe9d5dc13aa1bc5d2464e72a9d625bc9c2327f3346279d7ddcb651f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC548 10704 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.