Malicious PDF — malware analysis report

Static analysis result for SHA-256 1405526ca65babbc…

MALICIOUS

PDF

66.2 KB Created: 2020-08-07 10:19:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 797ad4611bc071764bba28e326467550 SHA-1: 72ad06b39c860b97213e08828770aa48401659e1 SHA-256: 1405526ca65babbc110bf7c36fa193980bc91ad3098dab14591bb866cb81bcbc
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'ttraff.com'. This URL is embedded within the document body, disguised as a link to a PDF about metabolic disorders. The PDF also hosts a large number of external PDF links, suggesting a link farm or SEO poisoning tactic. While no scripts were explicitly extracted, the presence of embedded URLs and the malicious redirector strongly indicate an attempt to lead the user to a malicious site, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=metabolic+disorders+of+bone+pdf
    • http://files.banginhardfireworks.com/uploads/1/3/0/7/130738755/9099253.pdf
    • http://wuzos.heathandhaveringurc.co.uk/uploads/1/3/1/0/131071164/xosoxafoxawepoko.pdf
    • http://files.chachocolacho.com/uploads/1/3/1/4/131411688/7994603.pdf
    • http://files.aplmf.org/uploads/1/3/1/4/131406275/zisatonefaki.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0431/6073/1803/files/rariwifomagereguwapavud.pdf
    • https://cdn.shopify.com/s/files/1/0430/8906/8185/files/types_of_biomes_worksheet.pdf
    • https://cdn.shopify.com/s/files/1/0427/6797/4556/files/74751144879.pdf
    • https://cdn.shopify.com/s/files/1/0434/3644/1752/files/amreli_express_news.pdf
    • https://cdn.shopify.com/s/files/1/0434/0046/2501/files/wibikenakaritodix.pdf
    • https://cdn.shopify.com/s/files/1/0438/5007/2224/files/siworekogolarejiloki.pdf
    • https://cdn.shopify.com/s/files/1/0429/9292/6873/files/12165009196.pdf
    • https://cdn.shopify.com/s/files/1/0434/9244/2264/files/77377525579.pdf
    • https://cdn.shopify.com/s/files/1/0431/4444/6118/files/68778721350.pdf
    • https://cdn.shopify.com/s/files/1/0439/1400/2587/files/a_noite_do_meu_bem_ruy_castro.pdf
    • https://cdn.shopify.com/s/files/1/0432/6467/1904/files/kilazeg.pdf
    • https://cdn.shopify.com/s/files/1/0433/8358/6977/files/34364926588.pdf
    • https://cdn.shopify.com/s/files/1/0434/0069/1866/files/vajoxupiwelafidojol.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000af13.bin
02cfe1978d9efd121f77cefdcd01d92edd8e0c542478e0b92ebc63415882f8d4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAF13 5292 bytes
font_01_sfnt_off0000c122.bin
82cc5a70efa9245a0c90b7314c6dcf4ad0a7bf45defde0220e07a46a2b68df06		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC122 10636 bytes
font_02_sfnt_off0000e5b4.bin
541fa2b6826b0add99b7d5a173ef1e6a5567607b5192f75b810eb17d6a563501		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE5B4 16204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.