Malicious PDF — malware analysis report

Static analysis result for SHA-256 ff777cf816c64f1e…

MALICIOUS

PDF

56.4 KB Created: 2020-08-30 07:01:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: eec904992e8209e704667d7f7fd42130 SHA-1: 262bbad88d64b74cd5bacaf8632c8344a3bff010 SHA-256: ff777cf816c64f1e27a0242b47a084731005ddd6245cd5264c42b52c0c41a341
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged as malicious by a machine learning classifier and contains numerous embedded links, with one identified as a known malicious redirector. The PDF_SEO_LINK_FARM heuristic indicates a mass of external PDF links, suggesting an attempt to manipulate search engine results or distribute content through a link farm. The presence of the URL 'https://ttraff.link/wix?keyword=girlvania+legs+and+feet' further supports the malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/wix?keyword=girlvania+legs+and+feet
    • https://imgfil.com/1j9b4g
    • https://cdn.shopify.com/s/files/1/0437/3220/5722/files/local_169._254_16.pdf
    • https://cdn.shopify.com/s/files/1/0436/9491/5738/files/humira_prescribing_information.pdf
    • https://cdn.shopify.com/s/files/1/0432/4425/7442/files/82889267794.pdf
    • https://cdn.shopify.com/s/files/1/0430/7383/1066/files/wumaziruwumulolirofusujog.pdf
    • https://static.usrfiles.com/ugd/b8c837_f85a0c8408f24b5a8176195d23d1c47f.pdf
    • https://static.usrfiles.com/ugd/b8c837_83f0769e4102485a8a3e32a7e1e7d435.pdf
    • https://static.usrfiles.com/ugd/912de2_ee8a467d03c2408c86f64bfc73867fad.pdf
    • https://static.usrfiles.com/ugd/7ea8bb_0db0c296dd4543c5b9567cac3e63f86a.pdf
    • https://static.usrfiles.com/ugd/136d07_83f1178494a94b2eb9801134596433f4.pdf
    • https://static.usrfiles.com/ugd/b8c837_453b49a91bbe4ca78793cb8de7d4e7ab.pdf
    • https://static.usrfiles.com/ugd/81d6a4_d10ea119eaf349669d00ba2ed6b91077.pdf
    • https://static.usrfiles.com/ugd/234f58_ec5567fbe14645eab1117917edee68cd.pdf
    • https://static.usrfiles.com/ugd/7ef0dc_f2b7ff1b7ec14916b34f439607c79861.pdf
    • https://static.usrfiles.com/ugd/9ff9b8_b49663c2e2554685a14592ad7bdcd814.pdf
    • https://static.usrfiles.com/ugd/12f4eb_80d427f11fc74b02a761a7dad1ca4422.pdf
    • https://static.usrfiles.com/ugd/be19e1_16084e7b0cdf4db2812c782a6895b6f9.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000084a9.bin
de1cb18e4cd2dcd9abbc284eb840f391c1d90910e16637c9026c39bd70234729		 pdf-font-stream PDF embedded font (sfnt) at offset 0x84A9 7032 bytes
font_01_sfnt_off00009cce.bin
dbd1f6064a6baa74df252a29f25157d645a6c0b9de7a1f61d6c1026ad567c65f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9CCE 5168 bytes
font_02_sfnt_off0000ae74.bin
7e4ab16b3f69c43f968d8b34ff4cbe44b32106fed4cfe6da0b13fb2d6f4051a5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAE74 10540 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.