Malicious PDF — malware analysis report

Static analysis result for SHA-256 085a5a2fd084de07…

MALICIOUS

PDF

61.8 KB Created: 2020-08-30 20:21:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9b008642c157db9f39bf004d878feeba SHA-1: d8ed0484ead841bedea43a659808511cf91ee825 SHA-256: 085a5a2fd084de07080f43b7d1b1e486d166ba689eaf1a2e0b33256d2e52aaf0
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a prominent link to 'ttraff.cc', identified as a malicious redirector. The document body, though heavily obfuscated, contains the same URL, suggesting an attempt to trick users into visiting a malicious site. The presence of numerous external PDF links, many pointing to benign Shopify domains, indicates a link farm or SEO manipulation tactic, likely to obscure the malicious redirector.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=a+glossary+of+literary+terms
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0430/9437/6605/files/zibulumu.pdf
    • https://cdn.shopify.com/s/files/1/0437/8312/7191/files/7268517624.pdf
    • https://cdn.shopify.com/s/files/1/0464/2488/3352/files/42622899010.pdf
    • https://cdn.shopify.com/s/files/1/0431/9176/3105/files/pin_diode_download.pdf
    • https://cdn.shopify.com/s/files/1/0430/0003/7527/files/certificato_di_conformita_farmacista.pdf
    • https://static.usrfiles.com/ugd/4d400c_641731ba81f741cbbb2b686acb116e9b.pdf
    • https://static.usrfiles.com/ugd/b8c837_d37f782aa0d8453083f83d42f24afbc5.pdf
    • https://static.usrfiles.com/ugd/b8c837_d0b3df93f20043799d682bf0cacd5b7d.pdf
    • https://static.usrfiles.com/ugd/432b07_985ac7061a4a49ada89e2f98757bc2c3.pdf
    • https://static.usrfiles.com/ugd/a2c2bc_79140eeca4824046bfe4b0fecc99a93c.pdf
    • https://cdn.shopify.com/s/files/1/0437/9194/1781/files/99939010329.pdf
    • https://cdn.shopify.com/s/files/1/0430/3205/1873/files/72750614084.pdf
    • https://cdn.shopify.com/s/files/1/0431/3314/1149/files/arquitectura_maya_caracteristicas.pdf
    • https://cdn.shopify.com/s/files/1/0433/3197/7370/files/57485184830.pdf
    • https://cdn.shopify.com/s/files/1/0433/2866/7816/files/maven_interview_questions_and_answers_edureka.pdf
    • https://cdn.shopify.com/s/files/1/0430/8857/6665/files/38426851557.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/22511335110.pdf
    • https://cdn.shopify.com/s/files/1/0431/9684/2142/files/kewakew.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b501.bin
d3c9258a30e36d92cc3505944db24fc76f38ea58cfcfe8b452ca11157f556289		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB501 5180 bytes
font_01_sfnt_off0000c695.bin
d49975a0db907bba98e4d0ad59a9278041a552931f7fb294e8590f8ee6e18668		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC695 10468 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.