Malicious PDF — malware analysis report

Static analysis result for SHA-256 0cab0d6a3ffe71cf…

MALICIOUS

PDF

37.8 KB Created: 2020-11-04 09:00:29 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-26
MD5: ee294c93af3cef8db94a9f2637dad384 SHA-1: 15835d284f71d547aac7cce7dbe16b237c857ba4 SHA-256: 0cab0d6a3ffe71cfe4f7a83eb10a67fb50a64a69ceafa3fbea728806f5ecac1e
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links, many pointing to potentially malicious redirectors, disguised as a product review. The heuristic 'PDF_MALICIOUS_REDIRECTOR_LINK' indicates that at least one URL, 'https://ttraff.club/123?keyword=hp+envy+17t+review+2019', is known to lead to malicious infrastructure. The document body itself contains obfuscated text and a reference to the same malicious URL, suggesting an attempt to drive traffic to malicious sites for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/123?keyword=hp+envy+17t+review+2019 In PDF document text
    • https://cdn-cms.f-static.net/uploads/4411922/normal_5f9d3d701bde0.pdfIn PDF document text
    • https://davijoxo.weebly.com/uploads/1/3/4/3/134357566/527104.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4413564/normal_5f9cd7d988dc3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4377112/normal_5f9fd8cc3d7a1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4375071/normal_5f945739e07e9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384036/normal_5f8f5a9664ad7.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/85f700ee-d1dd-4e7b-85d3-0bfb37c22f00/71990862213.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f0db4ac1-1d10-47cb-8cda-dfd7d2c57f5a/86116637137.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2277d4bc-50b9-48bc-a881-5210bc58c69c/94064137102.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0077dc4a-b17f-4374-8696-1287d96635ec/zewuwomaxunitifarapitaf.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/68d95349-1950-4a08-a221-b335fdcfe8f9/venuwededexipuguwadiru.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5154b176-777d-4d3f-90a0-501ebaa64687/88964712366.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/733de55c-f8ac-499c-9204-4a2969acb3a6/rolls_royce_silver_shadow_for_sale_cheap.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1ddd2f5f-db29-425c-8e6e-994e5e4f8565/apple_financial_statement_analysis_2018.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000054b2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x54B2 5172 bytes
SHA-256: d2b4717e33a266f1d212711a1a63ffc2d436cb9f32ab72c22a4dfbc583004c7d
font_01_sfnt_off00006687.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6687 10744 bytes
SHA-256: 3e144b9bd804766db781bdd8a32813223d31f17625c987b93184133d3d4f3411

Open this report in the interactive analyzer, or submit your own file for analysis.