Malicious PDF — malware analysis report

Static analysis result for SHA-256 157e3bbf7e48d599…

MALICIOUS

PDF

41.9 KB Created: 2020-09-21 00:24:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9fb7ba9049230d2b03edd6c05312446c SHA-1: cb7962e24ce22bd0913044c7d6358d0145893a04 SHA-256: 157e3bbf7e48d5998ff084b2893edb71573e4e92cd5d286398a11b2d65e4bef3
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links, many of which point to a redirector service. The primary malicious URL identified is https://ttraff.club/wix?keyword=2008+ford+super+duty+fender+flares, which likely leads to a phishing or malware distribution site. The document's structure suggests it's part of a link farm designed to improve search engine rankings for malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/wix?keyword=2008+ford+super+duty+fender+flares
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://28018e87-d7f4-4f14-96e4-efe5614bc81a.filesusr.com/ugd/771ea4_fbc093e152a44ba1aa7350f9f687cd59.pdf?index=true
    • https://01563efc-e654-4495-b510-1b3d8a41a0ed.filesusr.com/ugd/05301a_d6b1337d5f3e481e99e6a2e74125433b.pdf?index=true
    • https://59a59512-e06f-4ba7-90dc-f3087577aa77.filesusr.com/ugd/eb5a6a_fa15061467b54d70a13a4b58395272fe.pdf?index=true
    • https://22ad36b1-db27-4337-aaaa-060f0bd82721.filesusr.com/ugd/b98abb_4964263177334b099006f88933615299.pdf?index=true
    • https://cdn.shopify.com/s/files/1/0435/9903/6573/files/waste_management_information_in_marathi.pdf
    • https://cdn.shopify.com/s/files/1/0435/5181/7879/files/quadratic_form_symmetric_bilinear_form.pdf
    • https://b91e1d2c-ccff-4d58-b8ca-0ece6d00f633.filesusr.com/ugd/0a052f_d3ce422c49a84468a35b59432e76dadd.pdf?index=true
    • https://06f97e6e-6c93-48e7-812c-7975a83334bb.filesusr.com/ugd/436160_338ea70fb0b943458c6251f7b238dac5.pdf?index=true
    • https://1cb65cd9-53cb-47e1-83f0-d09201b9a992.filesusr.com/ugd/3cb6cb_39c84bdf1ea644339942178a3f5a5295.pdf?index=true
    • https://f2459a59-8c31-4c10-99f5-f03a9bb3dd51.filesusr.com/ugd/ebc5f9_69b138c66fb140d8bbc36123a9b68b7d.pdf?index=true
    • https://ac7d8dee-87d8-484c-ab43-46e56ab92414.filesusr.com/ugd/9219f8_79026fbc9e4b48e2b3a7b2de8d1f40e2.pdf?index=true
    • https://3caa5ecb-5b49-4779-b293-108c6eb9e5d6.filesusr.com/ugd/93c935_8bf7b4e76f1849d4a704484f4df0e0ad.pdf?index=true
    • https://2a6a9912-b2d2-4d31-9004-310de4f0bb50.filesusr.com/ugd/a42eed_bc5aaedd080243ff8e624c97682eca16.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006377.bin
55b380674c4da2cc8b3b41e1ab0ce6c96ab20ff11a63954416d4111ce2958c1c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6377 5512 bytes
font_01_sfnt_off00007649.bin
dde930c3c07542a7d6727353aa3a8a106b41b75b098edfa41a0c24ee6d9599de		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7649 10748 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.