Malicious PDF — malware analysis report

Static analysis result for SHA-256 bfef2f91489a59a7…

MALICIOUS

PDF

45.0 KB Created: 2020-09-05 20:52:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0229cac0b80809001ea413c323146f28 SHA-1: f6fc90da3b2c8e077658ce7e843d3416ac4e8716 SHA-256: bfef2f91489a59a7a6175aa3884c4ec371944a30bde18320d0343dfe3d502451
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains numerous embedded links, a significant portion of which point to a redirector service (ttraff.ru). This indicates a link farm strategy, likely for SEO poisoning or to obscure the ultimate malicious destination. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=bangalore+days+tamil+songs
    • https://cdn.shopify.com/s/files/1/0430/9018/2297/files/97331316577.pdf
    • https://cdn.shopify.com/s/files/1/0431/2406/4410/files/kimatodunoj.pdf
    • https://cdn.shopify.com/s/files/1/0433/0933/4683/files/critical_thinking_question_and_answer.pdf
    • https://cdn.shopify.com/s/files/1/0431/1705/2066/files/58367727752.pdf
    • https://static.usrfiles.com/ugd/6924eb_0be3500577574568abd96db77682a2d0.pdf
    • https://static.usrfiles.com/ugd/dba42a_8c153044a4344510b671c0a6427cd3df.pdf
    • https://static.usrfiles.com/ugd/941881_0db37e4748884e5c893ef0650e499e57.pdf
    • https://static.usrfiles.com/ugd/b8c837_163e8874deb34935ad4f2c67a3d5db7d.pdf
    • https://static.usrfiles.com/ugd/d94ae5_d4ac73cd4da94fb7a516510dbd61ceb4.pdf
    • https://static.usrfiles.com/ugd/225520_8bf6b100d3714c38aa2a60537a72cc25.pdf
    • https://static.usrfiles.com/ugd/b8c837_ab1ce2e910374072bfb857a175e262b6.pdf
    • https://static.usrfiles.com/ugd/685707_cae5e7b43bbe4032b80de6c474fb12ba.pdf
    • https://static.usrfiles.com/ugd/23b571_e6ae4fb98d1d4e13bcc6769f6e1719f2.pdf
    • https://static.usrfiles.com/ugd/de9003_74a133b293984824a20193306b5d5bea.pdf
    • https://cdn.shopify.com/s/files/1/0431/9572/8029/files/44603406894.pdf
    • https://cdn.shopify.com/s/files/1/0433/7503/4524/files/vigonip.pdf
    • https://cdn.shopify.com/s/files/1/0433/4583/8248/files/english_speaking_skills_improvement_tips.pdf
    • https://cdn.shopify.com/s/files/1/0433/9354/8444/files/stay_the_night_the_internet.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006b71.bin
1dfe7c001fb2f58fb9cdcda2204ffe04d5a08a409b95510a959a23e722104cc4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6B71 5296 bytes
font_01_sfnt_off00007d66.bin
fc282ae0c5a8e9d14d4a47c2a9287ecead4ee9ca90ac5adc914617e8487497cc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7D66 12996 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.