Malicious PDF — malware analysis report

Static analysis result for SHA-256 d4f97057173991ef…

MALICIOUS

PDF

39.7 KB Created: 2020-09-04 14:40:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2d88845e21f53363f5e547a10313e63d SHA-1: 6376362fda0e07f2edba95db052a1c7a31a162fb SHA-256: d4f97057173991efcbded0bdfd87991f749100bc57fa28aa8bbdf6e7205939bd
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

This PDF file exhibits characteristics of a link farm, with numerous embedded URLs pointing to external PDF documents. One of these URLs, 'https://ttraff.link/wix?keyword=film+beyond+light+years+sub+indo', is flagged as a malicious redirector. The document body, though heavily obfuscated, also contains this URL, suggesting a potential lure or redirection mechanism. The presence of many external links, combined with the malicious redirector, indicates an attempt to manipulate search engine results or distribute further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/wix?keyword=film+beyond+light+years+sub+indo
    • https://cdn.shopify.com/s/files/1/0467/9876/6229/files/filipino_reading_comprehension_worksheets_for_grade_10.pdf
    • https://cdn.shopify.com/s/files/1/0431/6495/8879/files/watch_friends_season_2.pdf
    • https://cdn.shopify.com/s/files/1/0434/4925/4041/files/differential_calculus_by_shanti_narayan_and_pk_mittal.pdf
    • https://cdn.shopify.com/s/files/1/0434/7238/8246/files/jegunagobefupojetexe.pdf
    • https://static.usrfiles.com/ugd/81ef4b_eb70105761284a6b961c1b82a837777f.pdf
    • https://static.usrfiles.com/ugd/40512e_5dbd2a948fbb4d978121e2e10e3215e6.pdf
    • https://static.usrfiles.com/ugd/48f461_4d4ef3e98bab4e30855b71f6ee9cd403.pdf
    • https://static.usrfiles.com/ugd/b8c837_2df6c566e62b470cab6cedf5e051cdec.pdf
    • https://static.usrfiles.com/ugd/a107db_a57c8bec67834196a501d21832699fb3.pdf
    • https://static.usrfiles.com/ugd/a1fb72_9a6cdb27dccb410690621833d6dd4f7f.pdf
    • https://cdn.shopify.com/s/files/1/0431/6486/0575/files/kawasitidopidofo.pdf
    • https://cdn.shopify.com/s/files/1/0431/7547/7416/files/input_type_file_accept_and_image.pdf
    • https://cdn.shopify.com/s/files/1/0432/9878/3382/files/kajewumiwofate.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000045e0.bin
a9735f7459d553cefa2bde2ec781e318eb96391ca5d1dfc47d572b992f1b5d11		 pdf-font-stream PDF embedded font (sfnt) at offset 0x45E0 6464 bytes
font_01_sfnt_off00005bd8.bin
16da0b5f98aba7a72f7fb018a1cdb6b64a62dbe8d118516eb6a28eb4898ed4f0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5BD8 5436 bytes
font_02_sfnt_off00006e29.bin
c6d4951d841199f4c4ad537c0be6072e23131dd0ccbcd7d2a9da06a6bb1e4824		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6E29 9924 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.