Malicious PDF — malware analysis report

Static analysis result for SHA-256 d6a481064aa754df…

MALICIOUS

PDF

45.3 KB Created: 2020-10-27 08:21:13 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-14
MD5: 6040a6129781d3891a3c769161673d34 SHA-1: e42db3979ea82bd7db8636106e4cb674ebe0e8a7 SHA-256: d6a481064aa754df2437bd8c7f549843dc453405b8a1859026f6962d6116232e
134 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'ttraff.com'. This indicates the document is designed to redirect users to a potentially harmful website, likely for phishing or malware distribution. The ML classifier also strongly flagged this PDF as malicious. No scripts were extracted, but the presence of a malicious link is sufficient evidence of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/123?keyword=palace+card+game+rules+7 In PDF document text
    • https://cdn-cms.f-static.net/uploads/4391893/normal_5f9549055b077.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367286/normal_5f8756665d6f9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369316/normal_5f886861102cd.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4417827/normal_5f96463e07e0d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4415782/normal_5f9775819608e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368266/normal_5f8ff1d158d1c.pdfIn PDF document text
    • https://bajusumuke.weebly.com/uploads/1/3/2/7/132741128/3047140.pdfIn PDF document text
    • https://foruvojupizife.weebly.com/uploads/1/3/4/3/134352799/javozebisebaxat.pdfIn PDF document text
    • https://vorenamu.weebly.com/uploads/1/3/4/2/134265490/gefesalinisaxijiwo.pdfIn PDF document text
    • https://voxapinave.weebly.com/uploads/1/3/2/7/132740917/wikusapa.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/5947b2f5-4019-4627-87da-c31a13445478/42011900179.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/af02cf45-7d69-4b67-8659-eaa06e25dc75/duruxepugi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6f7abbd9-e748-4144-952a-8e289a0bfa59/xiruretuwelifeki.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/514dacb8-645a-40cb-8f77-694382b3e5f3/essential_communication_ronald_adler.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/42dda8fe-f1e8-4a0f-b4db-2d7599bcb19c/92456537166.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0980c6ba-6136-4394-b3f0-960f05d2bd7a/lutisiduket.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0483/9597/6856/files/vomapano.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0486/4324/4200/files/zesarapelin.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000072bb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x72BB 5340 bytes
SHA-256: d814a0e30441de5dd6c7252aba90f3fbbea96b51da7165b947efb451ce9388b5
font_01_sfnt_off000084cc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x84CC 10560 bytes
SHA-256: 05052f9ddbcc773d9a054bbf4cfb5ae9a6b442a9c096e0301aca32b86d54ec80

Open this report in the interactive analyzer, or submit your own file for analysis.