Malicious PDF — malware analysis report

Static analysis result for SHA-256 e7d837c61a3f9a46…

MALICIOUS

PDF

35.2 KB Created: 2020-09-17 00:48:24 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e02598e076c7d1921b7b6f3044b9fd32 SHA-1: 31338d22a49977e299c763fa12e407283f697112 SHA-256: e7d837c61a3f9a46d7dfa633e0a33fe60bfc03bfbac479a3890990e7ef85021b
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains multiple embedded URLs, with one specifically identified as a malicious redirector. The document body, though heavily obfuscated, contains text related to a school bell schedule and the URL https://ttraff.club/wix?keyword=williams+middle+magnet+school+bell+schedule, suggesting a lure to a malicious site. The presence of a link farm and the ML classifier flagging it as malicious further support this assessment. No scripts were extracted, but the primary attack vector appears to be directing the user to a malicious external resource.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/wix?keyword=williams+middle+magnet+school+bell+schedule
    • http://gesuli.rescueber.org/uploads/1/3/0/8/130874067/d10eaa157b2d.pdf
    • http://folupe.bayareamuslimtherapists.org/uploads/1/3/1/3/131379163/1096155.pdf
    • https://65aa8e80-5264-42f6-8380-b9880482cb5b.filesusr.com/ugd/7921d2_da80cdb750574eeba988d17ee3b73e76.pdf?index=true
    • https://d780874b-0603-4eb7-a96b-8875614f3525.filesusr.com/ugd/e6092c_917c33da170842beb4ebd80bcdbf798b.pdf?index=true
    • https://b255fba9-9394-42b9-b210-ad05e39b4d6c.filesusr.com/ugd/0a052f_dc084134b7fd4cfea3ef9edb579d62df.pdf?index=true
    • https://8b051278-9216-4b61-98c1-6382dac66f30.filesusr.com/ugd/4c1554_f8a0af121083437e81929ce0f09f8aa9.pdf?index=true
    • https://0f707884-6939-4d4b-aa96-10f47d330724.filesusr.com/ugd/1acd69_98ae0b3d24054ace85c13deb91b4c9d0.pdf?index=true
    • https://cdn.shopify.com/s/files/1/0432/7030/7995/files/physiology_coloring_book_free_download.pdf
    • https://cdn.shopify.com/s/files/1/0437/2371/8805/files/muzepesadebojifumuru.pdf
    • https://cdn.shopify.com/s/files/1/0464/6132/1384/files/transformer_mon_garage_en_piece_a_vivre.pdf
    • https://cdn.shopify.com/s/files/1/0430/5358/0439/files/lotalobozopumuwo.pdf
    • https://cdn.shopify.com/s/files/1/0430/5027/0869/files/17817760767.pdf
    • https://cdn.shopify.com/s/files/1/0483/6048/9120/files/fake_drivers_license_maker_south_africa.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004b54.bin
0ac0b9426355ddfff3b253e9f024467f69b87c7248df4fe086b214a3ce910199		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4B54 5408 bytes
font_01_sfnt_off00005da1.bin
6b7de334f6099a95371aa760d68b0f127e507b2540ea96bd19ad6c427799e3a9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5DA1 10004 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.