Malicious PDF — malware analysis report

Static analysis result for SHA-256 13ca902a7eccc6d0…

MALICIOUS

PDF

51.6 KB Created: 2020-09-02 09:05:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f6ae56e550823f52be9c23d1f25885c7 SHA-1: 7e3bf9b24bb7bd2b13b9f667e53b88038a4e961c SHA-256: 13ca902a7eccc6d0357df9290f6148737427ebcb7b869bb6335e4735b5478991
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded links, with a critical heuristic identifying it as a redirector link farm. The primary URL, https://ttraff.com/pify?keyword=london+tourist+attractions+guide+pdf, is flagged as malicious. This suggests the document is designed to redirect users to malicious sites, likely for phishing or malware delivery, masquerading as a guide.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=london+tourist+attractions+guide+pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://static.usrfiles.com/ugd/0c4177_bb8f11ae2f0e4790a707472a225081c3.pdf
    • https://static.usrfiles.com/ugd/b47706_ce417144b5a4435fbf62e7adff91500a.pdf
    • https://static.usrfiles.com/ugd/30e015_1531a87e7bc44acd94ddbcaed8ff8d43.pdf
    • https://static.usrfiles.com/ugd/47b1e8_39b1885e2c2b4e8d9b47b44c8fb73458.pdf
    • https://static.usrfiles.com/ugd/270e53_ac9868489d784ce88eec33565ee25e22.pdf
    • https://cdn.shopify.com/s/files/1/0428/7250/4483/files/11491064586.pdf
    • https://cdn.shopify.com/s/files/1/0431/5987/9841/files/98313907979.pdf
    • https://cdn.shopify.com/s/files/1/0430/8933/0325/files/13822504896.pdf
    • https://cdn.shopify.com/s/files/1/0435/8592/9375/files/playboy_november_2011.pdf
    • https://cdn.shopify.com/s/files/1/0429/0409/2828/files/teponavobowakuboda.pdf
    • https://cdn.shopify.com/s/files/1/0430/8421/8532/files/94395549643.pdf
    • https://cdn.shopify.com/s/files/1/0437/9400/6177/files/zudulefis.pdf
    • https://cdn.shopify.com/s/files/1/0430/9280/3744/files/woxepiguz.pdf
    • https://cdn.shopify.com/s/files/1/0434/9113/1554/files/code._org_unit_3_test_answers.pdf
    • https://static.usrfiles.com/ugd/2b25b5_a45712e97ca946df947df4fcf64bf381.pdf
    • https://static.usrfiles.com/ugd/fbccce_d79097d86c654c16ad3fa404399313a7.pdf
    • https://static.usrfiles.com/ugd/b8c837_153e1287329848209452019ea5d5b110.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008bb6.bin
ea6fa87c2e5b2e42793c508152bf5cf3e25a9346e65a1908a430bf60232ecca9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8BB6 5232 bytes
font_01_sfnt_off00009d96.bin
f1ec80bb2f0b11c60804a639beedaf4eb6e1b2c1ac8495fa4f11cc29717d8daa		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9D96 10476 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.