Malicious PDF — malware analysis report

Static analysis result for SHA-256 13cd578253b4bb9c…

MALICIOUS

PDF

46.3 KB Created: 2020-09-19 23:36:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 65d7366aac2b1c21a45b9758e169f987 SHA-1: 610ca42d18e682d32c998249ffa024c268219389 SHA-256: 13cd578253b4bb9c21a2342922423f327ef5e986585994fd3b31e22462b5ab93
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF was flagged by multiple critical heuristics for containing malicious redirector links and a large link farm, indicating a probable SEO spam or phishing campaign. The embedded URLs, such as 'https://ttraff.club/wix?keyword=nioh+return+of+the+gourd+unlock', are likely part of this malicious infrastructure. Although no scripts were explicitly extracted, the nature of the embedded links suggests an attempt to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/wix?keyword=nioh+return+of+the+gourd+unlock
    • http://files.ottringhamchangingseasons.com/uploads/1/3/1/3/131382595/soganitoniwew_bokosasijirofo_fedisijo_xinudirali.pdf
    • http://files.livshairandbeauty.com/uploads/1/3/2/6/132681824/3751266.pdf
    • http://files.stbarnabaslinslade.uk/uploads/1/3/1/3/131384301/1219686.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://0ade3b17-2e42-43cd-b5b7-ae23f6fb00ac.filesusr.com/ugd/1c8c6c_64c634355d83466baf4223daf7f70d55.pdf?index=true
    • https://a8971108-5f87-4024-bdc7-f9b2c0576aa2.filesusr.com/ugd/7b00a0_db9be8ded69e41049d5038f1be75e8e9.pdf?index=true
    • https://a43b2b19-ee3a-4296-ada3-88dff9c4e8a6.filesusr.com/ugd/2813e2_d1f17704d38944bd8160089363eabc46.pdf?index=true
    • https://cdn.shopify.com/s/files/1/0427/7813/2636/files/fujolome.pdf
    • https://cdn.shopify.com/s/files/1/0439/9860/9566/files/metabolismo_cobalamina.pdf
    • https://cdn.shopify.com/s/files/1/0433/5258/8437/files/dewexamojitodugosaxu.pdf
    • https://2f5545a8-c7bf-4a25-843f-d88b06a5f980.filesusr.com/ugd/221eaa_5f323fd718894659a1c0293379f745ea.pdf?index=true
    • https://ff122001-3c8d-4cf3-9af6-328f397b0aa3.filesusr.com/ugd/10b11f_f94caa5c6ff34cf5a0567713859a5467.pdf?index=true
    • https://dae81836-6572-4043-809d-1ef50532610d.filesusr.com/ugd/d162e3_99c444ff399648209df8d146f803388d.pdf?index=true
    • https://f5d6e764-02ac-414f-aad1-14f21b2ea73e.filesusr.com/ugd/1d3654_c8f7a94840da4bdca2755056a0f7c71d.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006d43.bin
76c6454e52181e03af8982767afba72ddde73e796f93435281566eaf5ed74d0b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6D43 4928 bytes
font_01_sfnt_off00007e0c.bin
da80812aa7e5e3b9a451fe2f08876b8b0f620be3aafd9ed23404093f4402f974		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7E0C 15240 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.