Malicious PDF — malware analysis report

Static analysis result for SHA-256 123077b802434c2e…

MALICIOUS

PDF

47.8 KB Created: 2020-08-25 19:50:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a6900abb8922c184c85c959fc4c12885 SHA-1: de35e6d59aadc867b77631fa8809ea9ac8fb6b65 SHA-256: 123077b802434c2eaad3092ff225c15da4118ace06314aa493a4caa1e663a6db
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a link to a known malicious redirector, ttraff.cc, which is likely used to funnel victims to malicious sites or download further payloads. The document also exhibits characteristics of a link farm, with numerous embedded links to external PDFs, suggesting an attempt to manipulate search engine results or distribute content broadly. No scripts were extracted, but the presence of a malicious redirector is a strong indicator of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=ibm+tivoli+directory+server
    • http://pizadanis.veganfoodiefestival.com/uploads/1/3/1/1/131163601/2875550.pdf
    • http://pasoka.helenlangfordvoiceovers.co.uk/uploads/1/3/0/8/130814297/ximalajogebifa_xenawomuzejub_jufokimaz.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0437/6756/2394/files/list_of_active_learning_methods.pdf
    • https://cdn.shopify.com/s/files/1/0427/8065/5775/files/79988963529.pdf
    • https://cdn.shopify.com/s/files/1/0465/0821/2374/files/rpg_games_offline_for_pc_free.pdf
    • https://cdn.shopify.com/s/files/1/0432/0090/5373/files/alyscamps_arles.pdf
    • https://cdn.shopify.com/s/files/1/0436/6529/3462/files/mogigibo.pdf
    • https://cdn.shopify.com/s/files/1/0429/0940/1254/files/wobofozulimomisodo.pdf
    • https://cdn.shopify.com/s/files/1/0433/6920/1832/files/rulofuzojarexumuxew.pdf
    • https://cdn.shopify.com/s/files/1/0431/7904/9121/files/medical_biophysics_damjanovich.pdf
    • https://cdn.shopify.com/s/files/1/0434/5479/1832/files/modalegoji.pdf
    • https://cdn.shopify.com/s/files/1/0436/7443/5737/files/sacroiliac_joint_dysfunction_and_piriformis_syndrome.pdf
    • https://cdn.shopify.com/s/files/1/0437/4324/8545/files/cardiovascular_system_structure_and_function.pdf
    • https://cdn.shopify.com/s/files/1/0433/3702/3641/files/zozusevabo.pdf
    • https://cdn.shopify.com/s/files/1/0432/5851/1522/files/gpu_boost_2._0_download.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000078aa.bin
0b33b032354237f5e7f02f5e7065654bdc1b35ef30806f7504a26a32f8932f0e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x78AA 5112 bytes
font_01_sfnt_off00008a00.bin
3242a020db5b5142217cf3ffdafb23d31eb446113dfaf564977da8dc24ce1aab		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8A00 12556 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.