Malicious PDF — malware analysis report

Static analysis result for SHA-256 d68e357ca5f2ea6e…

MALICIOUS

PDF

41.4 KB Created: 2020-09-01 09:11:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0174335b31799da2f113962ff4173a5d SHA-1: 9f7a8168c57cf58a54965b8f2d604e62f854efc0 SHA-256: d68e357ca5f2ea6e7da7ac81be3b3b2d9df5b1500efb69843b77af5b35f8d939
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a link to a known malicious redirector, ttraff.cc, which is likely intended to lead the user to a phishing or malware distribution site. The document body, though heavily obfuscated, contains the same URL, suggesting it's the primary lure. The presence of numerous external PDF links also indicates a link farm strategy, common in SEO poisoning attacks.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=comparing+sexual+and+asexual+reproduction+pdf
    • https://static.usrfiles.com/ugd/b8c837_21cb4e68ab704fa3b620b496ca41d391.pdf
    • https://static.usrfiles.com/ugd/c068f8_fe350b05f1ff41768c75cc7c11ede0a5.pdf
    • https://static.usrfiles.com/ugd/b8c837_9f519e095f76478abb2581925e1b4bc7.pdf
    • https://static.usrfiles.com/ugd/4cf28d_c9ebf09be0144d419c90eb1c03082bbf.pdf
    • https://cdn.shopify.com/s/files/1/0428/7404/4579/files/movekugikoz.pdf
    • https://cdn.shopify.com/s/files/1/0430/9617/8845/files/79276557484.pdf
    • https://cdn.shopify.com/s/files/1/0434/4807/4405/files/nugejat.pdf
    • https://cdn.shopify.com/s/files/1/0437/1028/3931/files/rafubevikuko.pdf
    • https://cdn.shopify.com/s/files/1/0458/5426/1401/files/login_page_template_source_code.pdf
    • https://cdn.shopify.com/s/files/1/0430/6308/3162/files/52312216998.pdf
    • https://cdn.shopify.com/s/files/1/0454/1985/6028/files/3ds_games_decrypted.pdf
    • https://cdn.shopify.com/s/files/1/0432/7555/0884/files/75889166517.pdf
    • https://cdn.shopify.com/s/files/1/0437/2761/8209/files/human_anatomy_and_physiology_with_pathophysiology_book.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000063cd.bin
55b694eb4a1800d06210715ef01d20964e199da7f840bf258b5d8c8f83b1a6db		 pdf-font-stream PDF embedded font (sfnt) at offset 0x63CD 5448 bytes
font_01_sfnt_off00007641.bin
020a3521d3af7f46c00e6f1284e162758693160eaf11f56f145629184f7aecc7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7641 9972 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.