Malicious PDF — malware analysis report

Static analysis result for SHA-256 fe88d3159b5cd836…

MALICIOUS

PDF

40.2 KB Created: 2020-08-30 16:31:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: edad689af45135d29b494bf28694f7b3 SHA-1: aa18f0df163c522f3004499da22e3b3f600327b9 SHA-256: fe88d3159b5cd8369167371e558684b5ff60c97e9efee144baf3f4ff856d3fcc
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged as malicious by a machine learning classifier and contains a significant number of embedded links, many pointing to a redirector infrastructure. One critical heuristic indicates the presence of a PDF link farm, suggesting an attempt to manipulate search engine results or distribute malicious content through a large number of linked PDFs. The primary malicious URL identified is https://ttraff.ru/wix?keyword=joint+war+committee, which is likely used to redirect users to further malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=joint+war+committee
    • https://static.usrfiles.com/ugd/0c8cc8_b0431ac86c9a45b4a49f37107f8798d8.pdf
    • https://static.usrfiles.com/ugd/e643da_94586a2bdabd4c09902dc76533d6242e.pdf
    • https://static.usrfiles.com/ugd/b8c837_07afa77f3e634e66b134aafe6a3cc6c7.pdf
    • https://static.usrfiles.com/ugd/10b11f_7bacbd32d22f492f8bb8a64f1830b7ab.pdf
    • https://static.usrfiles.com/ugd/b8c837_3f859ae14ad842668a2045c447be4da2.pdf
    • https://static.usrfiles.com/ugd/b8c837_3c1e5031a51b4465b08fad6661fc2646.pdf
    • https://static.usrfiles.com/ugd/dc98cc_276b493440804c1f9f64deb31aad36b6.pdf
    • https://static.usrfiles.com/ugd/b8c837_032545bc579f4844a2adcab88841ae67.pdf
    • https://static.usrfiles.com/ugd/d1c05f_e94ee4c70fdd45cf9359406851dfa3d3.pdf
    • https://static.usrfiles.com/ugd/7ea8bb_e9002e44eb0a4538b8846d3b10c312c2.pdf
    • https://static.usrfiles.com/ugd/b8c837_d4cae5fa94474288b9034178c808b59d.pdf
    • https://static.usrfiles.com/ugd/b8c837_0d1c67659093413da620fc3c1c1b5d42.pdf
    • https://static.usrfiles.com/ugd/493135_3c83c9215ca649aea4437287cb4b60e7.pdf
    • https://static.usrfiles.com/ugd/63022f_a0680d55af9e498dae42ba465c2bb48a.pdf
    • https://static.usrfiles.com/ugd/b8c837_757c09b529124f6594e648253cb78e9c.pdf
    • https://static.usrfiles.com/ugd/b8c837_051ad0a2673f4287b6d7440a6db212f2.pdf
    • https://static.usrfiles.com/ugd/8b9728_9416028f5171460bb04a60590eab674e.pdf
    • https://static.usrfiles.com/ugd/be19e1_0ab268c023ce4d8e83a6cef34922dab1.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000061b1.bin
3da94cd980e2fb89ee81be53e89c4f19649c3df717cf7208fa58ee4a3ff635f5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x61B1 4816 bytes
font_01_sfnt_off00007208.bin
9c909f95afa922c7d3192dc89f4f09066d1ea81d5feb4745f022bf2ef97a54d5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7208 10160 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.