Malicious PDF — malware analysis report

Static analysis result for SHA-256 fc6ee0a53d7545d8…

MALICIOUS

PDF

41.9 KB Created: 2020-09-18 17:07:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2be47c602940211a71c3696b8f26e964 SHA-1: ed9931f6d8d60a75c3abe730e80b821b33a58909 SHA-256: fc6ee0a53d7545d8107e319006eb1e033a85f2f1efd15451a6a2b5384fa12d88
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF contains numerous embedded links, including a primary redirector link to 'ttraff.link' and a mass external PDF link farm pointing to various domains. The document body, though partially obfuscated, suggests an educational context ('Algebra 2 solving systems of equations by graphing worksheet answers') used as a lure. The ML classifier strongly indicated maliciousness, and the PDF_MALICIOUS_REDIRECTOR_LINK heuristic confirms the presence of links to known malicious infrastructure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/wix?keyword=algebra+2+solving+systems+of+equations+by+graphing+worksheet+answers
    • http://virepewi.reelresin.com/uploads/1/3/0/7/130775531/kowilotawomovam.pdf
    • http://files.carplakesfrance.co.uk/uploads/1/3/1/3/131379246/2302a8e05183.pdf
    • http://files.countrycreations4u.com/uploads/1/3/2/6/132695575/birofexo.pdf
    • http://videgafix.mightygreen.com/uploads/1/3/1/4/131438888/8727020.pdf
    • http://nobezan.royalqueendom.com/uploads/1/3/1/4/131453512/401ae3b2dda217.pdf
    • http://naginanux.jessicaleemanton.com/uploads/1/3/1/4/131406676/silariza.pdf
    • http://jotolu.psychoneconference.org/uploads/1/3/2/8/132815196/zepikoxamatem_fajusaromofeluz_sinesuvu.pdf
    • http://xotis.yamayogacollective.com/uploads/1/3/2/3/132303229/00dcb45a0219b.pdf
    • http://lidapunu.urqigong.com/uploads/1/3/0/9/130969723/5516672.pdf
    • https://4ade458e-dac3-4390-a02e-b
    • https://cdn.shopify.com/s/files/1/0428/8829/8659/files/69274702250.pdf
    • https://cdn.shopify.com/s/files/1/0440/2541/3782/files/gezegax.pdf
    • https://cdn.shopify.com/s/files/1/0433/5792/9623/files/sakura_dungeon_luck_statue.pdf
    • https://cf088d8a-1a80-4793-a990-c21c1c8e9e52.filesusr.com/ugd/880a7e_2d84d5b319e948d58fefe80d5ff3e6db.pdf?index=true
    • https://47048abb-889b-4734-b1f2-0853ce5066e3.filesusr.com/ugd/031dda_12ba389f337a411093c528b652985d80.pdf?index=true
    • https://97d746e6-48c5-494b-a5aa-5fcca1573702.filesusr.com/ugd/93c935_aedeee518db04bd083e5933d83c86c28.pdf?index=true
    • https://10aaaff3-b944-4a23-8741-f192043f1516.filesusr.com/ugd/b1b16e_22896dd1dae444d386cec345ace56789.pdf?index=true
    • https://4ade458e-dac3-4390-a02e-becc1ad826df.filesusr.com/ugd/1479de_32abb783281b4c168779993ebd1c422d.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000062dc.bin
d4677f8fb298d61dac84c411927767351e8566e0539c9ef76410ab11089623a1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x62DC 6020 bytes
font_01_sfnt_off0000774c.bin
b5d0533e680a436cfed929ed3cfd0b0a060c848fc501ea11f14225c6c1d8f06f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x774C 10168 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.