Malicious PDF — malware analysis report

Static analysis result for SHA-256 fc8095d2ec6a6fd9…

MALICIOUS

PDF

46.5 KB Created: 2020-08-06 12:12:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: df2df8291d7520f4b6dfd9c77d854d58 SHA-1: d7054367cb033cdfdff180929096b8b9e076fee8 SHA-256: fc8095d2ec6a6fd998492f16d5e1b872ef521a9c3b2dc2010a3fa266d6e18b1a
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains numerous links, including one pointing to a known malicious redirector, ttraff.cc. The document body, though partially corrupted, suggests a lure related to 'sociology 101 final exam questions pdf'. This indicates the document's primary purpose is to redirect users to malicious sites, likely for further exploitation or phishing. The ML classifier strongly supports the malicious nature of this PDF.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=sociology+101+final+exam+questions+pdf
    • http://files.lisakamal.com/uploads/1/3/2/3/132303083/jodoxaje-bemevuwat-nutewojivid.pdf
    • http://files.ogdenroofers.com/uploads/1/3/0/9/130969535/nivimozagan_zoziwofemuna.pdf
    • http://files.fairhopecenterforthewritingarts.org/uploads/1/3/0/9/130969703/1319259.pdf
    • http://files.jacquesummers.com/uploads/1/3/2/6/132681409/rizebavulifa.pdf
    • https://cdn.shopify.com/s/files/1/0432/3947/3314/files/jepesetiza.pdf
    • https://cdn.shopify.com/s/files/1/0434/6016/5797/files/filojige.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/tavolotifejenirogamofiv.pdf
    • https://cdn.shopify.com/s/files/1/0432/1263/6322/files/bridgeport_milling_machine_for_sale.pdf
    • https://cdn.shopify.com/s/files/1/0435/6728/4387/files/jewiwujosiledolexidi.pdf
    • https://cdn.shopify.com/s/files/1/0430/6026/5117/files/73630289041.pdf
    • https://cdn.shopify.com/s/files/1/0432/2947/9076/files/gba_emulator_iphone_8._4.pdf
    • https://cdn.shopify.com/s/files/1/0431/4795/2294/files/autobuses_madrid_toledo.pdf
    • https://cdn.shopify.com/s/files/1/0435/1423/2984/files/26565294036.pdf
    • https://cdn.shopify.com/s/files/1/0429/1218/6531/files/69162235412.pdf
    • https://cdn.shopify.com/s/files/1/0434/5869/1232/files/cartooning_philosophy_and_practice.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006d0c.bin
ef10d7be7c4f257a4538bb19fb8d032beaf6ccc291dcd82181b1e182046709ff		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6D0C 2064 bytes
font_01_sfnt_off000076a9.bin
b0b15436cb563d78a413454066276ff04cb551d0fcd908a189c72eca8cfe589a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x76A9 5972 bytes
font_02_sfnt_off00008aff.bin
b115b37185a800019d04f06e11bb0ccfe778799213dd73450ba1e0dffcbf8d07		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8AFF 9872 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.