Malicious PDF — malware analysis report

Static analysis result for SHA-256 0f0cfd37d2041604…

MALICIOUS

PDF

35.0 KB Created: 2020-09-20 13:36:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b4ba6dc950a3c3cbe26a19d2a3e6695f SHA-1: 82e6b88583d9aac65d7a74924bfc64e31bf7f894 SHA-256: 0f0cfd37d2041604ba2abb0a2c919daad9e35efb5f343ab16eb1c0357ef8e77a
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links, many of which point to redirector infrastructure. The primary malicious link identified is https://ttraff.link/wix?keyword=lachlan+merch+youth, which is designed to lead users to potentially harmful content. The ML classifier strongly flagged this PDF as malicious, supporting the conclusion that it is part of a phishing or scam campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/wix?keyword=lachlan+merch+youth
    • http://files.ambodywork.com/uploads/1/3/1/3/131398406/1159197.pdf
    • http://nagatofid.braziercoffeeroasters.co.uk/uploads/1/3/1/3/131380128/ziropud_tiputagewirutu_latojatada.pdf
    • http://files.firstumcgalesburg.org/uploads/1/3/2/8/132815175/kilefite.pdf
    • http://guwak.caffcofloraloutlet.com/uploads/1/3/1/0/131070611/9555055.pdf
    • http://files.leeluummakeupartistry.com/uploads/1/3/1/4/131483002/2671974.pdf
    • http://walubeviw.mobilservredlist.com/uploads/1/3/0/7/130775280/kogofalebumikudazidi.pdf
    • http://files.skipscards.com/uploads/1/3/0/8/130874050/f0a113.pdf
    • http://files.futura-foundation.co.uk/uploads/1/3/0/8/130813111/7e92af887c3f303.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://cdn.shopify.com/s/files/1/0440/4376/3862/files/hyperdimension_neptunia_rebirth.pdf
    • https://cdn.shopify.com/s/files/1/0430/4211/1650/files/sigizimozibamagazilezut.pdf
    • https://77bca001-fb66-45aa-b5d1-42ed753768d2.filesusr.com/ugd/3b0c81_de2da42c1b7548808964fc771f25ff04.pdf?index=true
    • https://991c8684-0909-43ab-b9fb-c86b23a2b6dd.filesusr.com/ugd/a4e402_3a7e238a2685493582c73e4571072aba.pdf?index=true
    • https://74daa3ef-e0b0-4620-87b0-bbfc00b06fdf.filesusr.com/ugd/270e53_2873dd4cb3a14af28ed973c940308002.pdf?index=true
    • https://ad68af3b-9c21-42af-98b7-db6cd7224c48.filesusr.com/ugd/dfb5f8_e94d7ffdeed94545bfd6bd8b6381362a.pdf?index=true
    • https://a9d35355-c4b9-4e8f-bff8-84d59a3de0e1.filesusr.com/ugd/b81754_5ae7fb64d33f462fbf364b9b0395f567.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000427a.bin
cb67efed26411a57684247dcb9a0c8f3b74e5bf34b8827b94893bdeb084abd9c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x427A 4736 bytes
font_01_sfnt_off00005258.bin
fd69757807ec9c75f37433cfc4a4752564bd9935234225e853ba5af6252d6e7e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5258 9000 bytes
font_02_sfnt_off00007124.bin
9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7124 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.