Malicious PDF — malware analysis report

Static analysis result for SHA-256 d37555ec2cac7225…

MALICIOUS

PDF

35.3 KB Created: 2020-08-31 07:06:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a2d241eb994eaec84b877d68194259a2 SHA-1: cdd889ae1f754eedba7146d0d07adcd0df96f5b2 SHA-256: d37555ec2cac7225e1c1283383b6f723d920cbda0950d42e218a544ffb1412cf
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a mass link farm, with the primary malicious URL being https://ttraff.ru/wix?keyword=drugged+high+on+alcohol+documentary+worksheet+answers. This URL likely redirects to a malicious payload or phishing page. The document body, though heavily obfuscated, contains references to the worksheet topic and the malicious URL, suggesting a social engineering lure. No scripts were extracted, limiting the analysis of further execution steps.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=drugged+high+on+alcohol+documentary+worksheet+answers
    • https://cdn.shopify.com/s/files/1/0439/7072/3998/files/kebogonenotuxekanunelej.pdf
    • https://cdn.shopify.com/s/files/1/0431/5817/5901/files/bhagat_singh_birthday_images_free.pdf
    • https://cdn.shopify.com/s/files/1/0434/7274/8709/files/vimebupile.pdf
    • https://static.usrfiles.com/ugd/38eac1_2fac38d1d6f7411686497ce0b651b458.pdf
    • https://static.usrfiles.com/ugd/271e65_4c56e503ab094492b506a59ecfe5c2b8.pdf
    • https://static.usrfiles.com/ugd/ea9bdf_3fe0349fda5646788794412c0442c221.pdf
    • https://cdn.shopify.com/s/files/1/0461/3852/3801/files/what_does_atgw_mean.pdf
    • https://cdn.shopify.com/s/files/1/0427/8029/5334/files/31116487370.pdf
    • https://cdn.shopify.com/s/files/1/0434/4381/4560/files/73675195894.pdf
    • https://cdn.shopify.com/s/files/1/0438/1717/3149/files/zipitugo.pdf
    • https://cdn.shopify.com/s/files/1/0431/6895/6565/files/ansys_workbench_contact.pdf
    • https://cdn.shopify.com/s/files/1/0436/6296/6937/files/zorejenixikexona.pdf
    • https://cdn.shopify.com/s/files/1/0434/3506/5505/files/4084797045.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004bab.bin
8dd1a79e4e0366541a3d6e083730b9d69fc7d0f57350713b3b3fcafe93874e0a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4BAB 5612 bytes
font_01_sfnt_off00005ea6.bin
d759366c579de69ccee5e9d37c6231f511b74da8c3f346bea9e0ac7d6a1126ef		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5EA6 9780 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.