Malicious PDF — malware analysis report

Static analysis result for SHA-256 e6fac7e8e97ea6dd…

MALICIOUS

PDF

51.0 KB Created: 2020-08-30 08:04:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d6a13e92cec7c0666e737f3dafb25395 SHA-1: 73d4d64d9e4677043822a03448aab03d659da9ca SHA-256: e6fac7e8e97ea6dde88ffa8d3ab3bbab2129e30be5926f245a8c5002129fd59d
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains numerous links, including one pointing to a known malicious redirector at `ttraff.club`. The document body, though heavily obfuscated, contains this URL and references to 'sports day anchoring script in hindi', suggesting a lure. The presence of many external PDF links indicates a link farm strategy, likely to improve SEO for malicious content or to distribute further payloads. No scripts were extracted, but the PDF structure itself is used for malicious redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/wix?keyword=sports+day+anchoring+script+in+hindi
    • https://cdn.shopify.com/s/files/1/0432/3839/1970/files/78198845203.pdf
    • https://cdn.shopify.com/s/files/1/0433/1290/6405/files/popobokoweneg.pdf
    • https://cdn.shopify.com/s/files/1/0433/0923/6374/files/12871828548.pdf
    • https://cdn.shopify.com/s/files/1/0437/8342/2109/files/gusimid.pdf
    • https://cdn.shopify.com/s/files/1/0430/2507/2282/files/pigotubuxolug.pdf
    • https://cdn.shopify.com/s/files/1/0430/4456/9242/files/tolewagixinoxaf.pdf
    • https://cdn.shopify.com/s/files/1/0430/9080/4885/files/nunowivujimesililidu.pdf
    • https://static.usrfiles.com/ugd/b8c837_80d801aaee1948f588f258b845f024c8.pdf
    • https://static.usrfiles.com/ugd/0049ca_cda32a900b514c5ead5f303cda1e43df.pdf
    • https://static.usrfiles.com/ugd/12f4eb_e49e69be1d6547bb9be6afee076f1349.pdf
    • https://static.usrfiles.com/ugd/3b47cb_2067d47a03ca4fa5b2c45171f4bd7dd3.pdf
    • https://static.usrfiles.com/ugd/0dcf4b_3da6a1ca9b694ffda56b91691a2bade7.pdf
    • https://static.usrfiles.com/ugd/8b49c6_ccd3422a9cf64c45ae3f4a7a61ac2722.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000572d.bin
1bc10b66197b780a0ce3ab843b6bf74275f2ae05625a3232a3d8a7b78f51a116		 pdf-font-stream PDF embedded font (sfnt) at offset 0x572D 5180 bytes
font_01_sfnt_off000068af.bin
b91f3c26f37c28538ed09035cbea6f9221827f1e30b50c452f08cc820bcc167b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x68AF 3720 bytes
font_02_sfnt_off00007411.bin
3aa4093da7d4b3a197eee4ae6043b65197a804249a8dec6085ca388fed1b43a7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7411 9700 bytes
font_03_sfnt_off00009531.bin
d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9531 4324 bytes
font_04_sfnt_off0000a332.bin
92d19f878cbd2ac04f19c7a9b9c665121cda244868b9f138b3787ead803d4a16		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA332 7340 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.