Malicious PDF — malware analysis report

Static analysis result for SHA-256 04bb5c95a2bd2308…

MALICIOUS

PDF

41.1 KB Created: 2020-09-19 19:28:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8e941071ec4ec912b144c3e345790fe9 SHA-1: ce7c91468874f05d4431b6c747349a3f61aa65a7 SHA-256: 04bb5c95a2bd230880d068494786a694ff1402be4e1c362948986c2bbb022570
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links, with a critical heuristic identifying it as a malicious redirector. One of the primary links, 'https://ttraff.me/wix?keyword=night+chapter+5+answers', is flagged as malicious. The document body, though heavily obfuscated, contains references to this URL and appears to be a lure for 'night chapter 5 answers', suggesting a phishing or scam attempt. No scripts were extracted, but the PDF structure itself facilitates the malicious redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=night+chapter+5+answers
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://96b94df6-8f2e-4f6c-ada5-d8ff1bd9520d.filesusr.com/ugd/ad8f3a_666b548701a04dd38b8f61cdc8e72c0d.pdf?index=true
    • https://11a0c609-e15d-47d1-ba33-eb5752b821be.filesusr.com/ugd/8d0191_75cdbfe872b74e85b37abfca0409c77e.pdf?index=true
    • https://77ca4ceb-d291-4c40-8286-b40728fa073e.filesusr.com/ugd/5f226b_0a11fedacfb44f9c8bd05d710fd46082.pdf?index=true
    • https://1d6caa75-a575-4db0-bc85-ad2b03919359.filesusr.com/ugd/38062a_0f73850d93b2465b96cb5707dc4dd916.pdf?index=true
    • https://ed57389a-e039-4d43-a19e-740323bc850f.filesusr.com/ugd/253000_6fe6e362f66e48848e109592cbc39826.pdf?index=true
    • https://3d1523ec-8967-44ef-a005-d0080c2a3c18.filesusr.com/ugd/948cea_1cea7cce81b24554bcabb88c5d957cf4.pdf?index=true
    • https://252348aa-8529-4716-b2c1-c06eafd4046e.filesusr.com/ugd/8bc2a6_07e59d9411e24e1e917f79c8b2b0e4b8.pdf?index=true
    • https://a0e3824e-aad5-4d7c-aa3b-8f772a387d23.filesusr.com/ugd/6f9b04_08b3169a2dfb49b4abadd0959fdb5780.pdf?index=true
    • https://cbc63936-3061-47e5-8640-ce4437c6af8c.filesusr.com/ugd/e3834b_dea28caf8cdc4a97b437235b0857b3b6.pdf?index=true
    • https://c777276a-41eb-48d0-9873-f5d54c747729.filesusr.com/ugd/c4ccc4_4799a8cc33d14a9caf343ca70a93718b.pdf?index=true
    • https://847eaabb-410f-4f68-9c77-a32ccb6c0e16.filesusr.com/ugd/286fb8_63d8eed99d084b30a67cf8293127b8af.pdf?index=true
    • https://cf8ca5d2-a6e9-48b8-8707-87bb59e7aa8a.filesusr.com/ugd/98857b_97ce59d881394921bd9bf80a2809e0e8.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000063db.bin
59b7ec730ade92b930313baae0096a699716328149a26b65ebe6bf7946d9b633		 pdf-font-stream PDF embedded font (sfnt) at offset 0x63DB 5348 bytes
font_01_sfnt_off00007627.bin
248f838db1d28fe27ac91cff3545d60510eeeaffbcc151b3601cb34787502786		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7627 9848 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.