Malicious PDF — malware analysis report

Static analysis result for SHA-256 e82cdc3da128bfb3…

MALICIOUS

PDF

43.1 KB Created: 2020-09-04 20:24:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 14a6f5c7f01703952f5449d908da6f17 SHA-1: 69a14d8eb5e2a1b3cac4575490593955ebe31a7f SHA-256: e82cdc3da128bfb3a0cf74e27fe3ffa372c4587c2819eb3bb9a7365041654a80
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'ttraff.club'. The document body, though heavily obfuscated, contains text related to 'probability worksheet gcse pdf' and the malicious URL, suggesting a lure. The presence of numerous embedded links, many pointing to Shopify, indicates a link farm strategy, likely to obscure the malicious destination. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/wix?keyword=probability+worksheet+gcse+pdf
    • https://cdn.shopify.com/s/files/1/0449/7742/2494/files/vert_shock_workout_free.pdf
    • https://cdn.shopify.com/s/files/1/0440/5071/0693/files/43987465257.pdf
    • https://cdn.shopify.com/s/files/1/0429/6481/1927/files/68726498306.pdf
    • https://cdn.shopify.com/s/files/1/0431/1669/1612/files/chappelle_show_download.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/6733015585.pdf
    • https://static.usrfiles.com/ugd/9e14ca_296c9f9dcae54b08b7d06cbbd712fd8a.pdf
    • https://static.usrfiles.com/ugd/daca0d_6209debcb1a74ff4a988c079966a1f50.pdf
    • https://static.usrfiles.com/ugd/2813e2_d59b8a66701d41dab2f811e867057b6b.pdf
    • https://static.usrfiles.com/ugd/20d83a_36c26551cafc446eaa2d7f38ba5c2c70.pdf
    • https://static.usrfiles.com/ugd/94e5ef_a763dcd383374b05987d536b72111624.pdf
    • https://static.usrfiles.com/ugd/2ac701_d7123304fd8f49d48c9c125699f40d1c.pdf
    • https://static.usrfiles.com/ugd/39cb9d_01d88881882645d8849990d22cbd0718.pdf
    • https://static.usrfiles.com/ugd/b8c837_dfe136bcdc9e448dbf4c3a112f7ebd87.pdf
    • https://static.usrfiles.com/ugd/8d57bd_6d807f86faad4dde9b1ed07ee5664cc9.pdf
    • https://static.usrfiles.com/ugd/8e9e2f_0ee04c1ea3fa4d03ab2506805390f40d.pdf
    • https://static.usrfiles.com/ugd/c1de29_6e27f578300a41ada68debf9a6a5139e.pdf
    • https://static.usrfiles.com/ugd/838e7e_3509bc813dfa46a291906de57a7b00dc.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006840.bin
8b05e670ba74ff07375f250118c8a29fff126debd61076f5ecf33e5df61f2ff3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6840 5816 bytes
font_01_sfnt_off00007c1e.bin
5c88b83dfb4604261f8d29a9dee505b66167da8f44e471a58043c0df15f14ea3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7C1E 10528 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.