Malicious PDF — malware analysis report

Static analysis result for SHA-256 02296fc357bb586d…

MALICIOUS

PDF

46.0 KB Created: 2020-07-29 14:16:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b37e5efca2339581b0b64f65e3c5e466 SHA-1: f12247dec949f2f0c6fdb6914975a31a2469183b SHA-256: 02296fc357bb586dc9c1e27a166b1f2b17ecdf14dc728be30cdec3e5be3b4269
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'ttraff.com'. This indicates an attempt to lure the user to a potentially harmful site. The document body, though heavily obfuscated, contains text related to trading strategies, likely a lure. The presence of numerous embedded links, many pointing to Shopify domains, suggests a link farm or content distribution strategy for malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=automated+trading+strategies+with+c+and+ninjatrader+7+pdf
    • http://files.beaconchurchofchristgbctx.com/uploads/1/3/1/8/131857419/lifuvubaxabises_zafuwir_xipexos_vuvufokifiv.pdf
    • http://files.landcom.co.uk/uploads/1/3/1/4/131483361/4904230.pdf
    • http://files.lakesideranchandresortfl.com/uploads/1/3/1/3/131380771/bakuxesof-zabusof-joxawem.pdf
    • http://files.tamarindbookclub.com/uploads/1/3/1/1/131164414/4049151.pdf
    • http://files.bwstook.com/uploads/1/3/1/4/131437683/410264.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0427/4470/9276/files/43475061340.pdf
    • https://cdn.shopify.com/s/files/1/0435/5876/4696/files/21824738875.pdf
    • https://cdn.shopify.com/s/files/1/0438/1350/3133/files/vumivafumotodilajaguzof.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/dazexirorojukulovamedifuv.pdf
    • https://cdn.shopify.com/s/files/1/0430/3667/2162/files/94788642570.pdf
    • https://cdn.shopify.com/s/files/1/0433/0805/6740/files/tupexilegor.pdf
    • https://cdn.shopify.com/s/files/1/0432/9934/0448/files/22410926834.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/89120948070.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/57032902602.pdf
    • https://cdn.shopify.com/s/files/1/0433/3164/9689/files/burovezutufise.pdf
    • https://cdn.shopify.com/s/files/1/0430/3123/2674/files/luzobuputuwupax.pdf
    • https://cdn.shopify.com/s/files/1/0430/5177/8202/files/56884895813.pdf
    • https://cdn.shopify.com/s/files/1/0435/9107/3947/files/57117104038.pdf
    • https://cdn.shopify.com/s/files/1/0428/9105/1161/files/24726740421.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000752d.bin
8eaf33b0cb6a563ee2a74f819575d0563a8cc1f5357e2be61f7552bf854d4474		 pdf-font-stream PDF embedded font (sfnt) at offset 0x752D 5656 bytes
font_01_sfnt_off0000885d.bin
9ce258341b906f2858a784ca33a838407f5ce856e82be3dbf82732fe6be96784		 pdf-font-stream PDF embedded font (sfnt) at offset 0x885D 10056 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.