Malicious PDF — malware analysis report

Static analysis result for SHA-256 04d99fd37f065207…

MALICIOUS

PDF

60.5 KB Created: 2020-08-31 13:25:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ae2404369aae81305b69c9e41e4df99e SHA-1: 36eac4b71e1b26c05084dbaa517b34fcd3ef0a7d SHA-256: 04d99fd37f065207708a7d38298e9401bac1cc308bd5dd16cf194b8b870adcce
162 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF contains a malicious redirector link pointing to 'https://ttraff.ru/wix?keyword=descargar+musica+mp3+clip.dj', which is flagged as malicious. The document body, though heavily obfuscated, contains a reference to this URL and appears to be a lure for downloading MP3s. The presence of numerous external PDF links suggests a link farm or SEO poisoning attempt to distribute malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=descargar+musica+mp3+clip.dj
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://static.usrfiles.com/ugd/b77b08_82088c521af54c5c9d883468c360f8d9.pdf
    • https://static.usrfiles.com/ugd/a2ebd8_13f4bb4773e0409eb4ddcae48c87e840.pdf
    • https://static.usrfiles.com/ugd/b8c837_72a77c6f42df4815a362f73cc5c5168a.pdf
    • https://static.usrfiles.com/ugd/3f4b99_dc52cc050d874290aeafe50e61286e01.pdf
    • https://static.usrfiles.com/ugd/4dd980_08d0027c166e4e87be9da24e87de2da7.pdf
    • https://static.usrfiles.com/ugd/868401_02b7949e42db41b8b734b9698b84aa7c.pdf
    • https://static.usrfiles.com/ugd/0d002d_1bd49012247c49fd92f8c8a72a9f044c.pdf
    • https://static.usrfiles.com/ugd/b8c837_db5137a3c7904d6e862e689d545f7115.pdf
    • https://static.usrfiles.com/ugd/c3f59f_e40e9c23700244569f155d8b551cfb9d.pdf
    • https://static.usrfiles.com/ugd/ca9b0a_5c7db02efdb74a38b6b0ef2a9d417fec.pdf
    • https://static.usrfiles.com/ugd/739437_c5c27e777b35413d88527dde33362f2d.pdf
    • https://static.usrfiles.com/ugd/b8c837_39f0f66d1d6e4fa6876cafb002f957c2.pdf
    • https://static.usrfiles.com/ugd/b8c837_09334912cfe84fe58a2eb31cacd0fefb.pdf
    • https://static.usrfiles.com/ugd/b8c837_50c7a0ed92414a5fb6d957d863bfd23a.pdf
    • https://static.usrfiles.com/ugd/82e28d_34a86bc127a9427bae1f5fd17b744538.pdf
    • https://static.usrfiles.com/ugd/0d002d_6c38590f1ab84647960f8479af47be5b.pdf
    • https://static.usrfiles.com/ugd/b8c837_5bdb69c9859f41878e8daa0600737776.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html
    • http://scripts.sil.org/OFL

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_007_off0000c454.bin
89d47fc8f9c93ee13b786d1f6a28faf04776418cba99863958cbee0565148347		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xC454 19752 bytes
font_00_sfnt_off00007616.bin
2ce5a7286efefc5aae27ce1c31b3347e159d00bd30cf97f509a0b7f7d49caffb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7616 6440 bytes
font_01_sfnt_off0000860b.bin
71b6c77057d45e3a315cacb7382b8695ae799f0d0947c6d79815d4c2907e8547		 pdf-font-stream PDF embedded font (sfnt) at offset 0x860B 5664 bytes
font_02_sfnt_off00009945.bin
85af179e49b2a61d063ac4b7f2fb797370478771d692266ae29bf1a598e56d9d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9945 13680 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.