Malicious PDF — malware analysis report

Static analysis result for SHA-256 17730b4a8fb51afd…

MALICIOUS

PDF

44.1 KB Created: 2020-08-30 10:41:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b88f4565451359619f05eb3653d8f796 SHA-1: 344c54a4e36ff4e4e4fa6b91a07430475ee45313 SHA-256: 17730b4a8fb51afd1561ac4b6baa90357c7100b4ef568e15dbaf762ddcf71325
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file contains numerous embedded links, with a critical heuristic firing indicating it points to known malicious redirector infrastructure. The document body, though heavily obfuscated, contains a URL that appears to be part of a link farm designed to drive traffic to potentially malicious sites. The primary malicious URL identified is ttraff.com, which is flagged as a redirector.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=10+mindframes+for+visible+learning In PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://static.usrfiles.com/ugd/b8c837_779f679d34cc4bf49bc449e7b4a11641.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/5a1791_f1cad22b586e40a7a1ab197679acea56.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/429b25_365baec4cf114a00922f3ee98e1759b3.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/4f270c_eb41c1d2192546cb9444c68d06cb413b.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/4cf28d_d11f9f71841f435e9055fed8661016f5.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/7603ae_0cbdae19b3244d78aa2ea4e45a18f35a.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/5b5da7_f737c127e7a64750865304b7b2adecc1.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/5926b4_adc152f53ad7439f92a8abc951f45962.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/b8c837_f66ac0daeb2f408eb6c9e2a914be82ff.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0433/8217/7946/files/alphabet_letters_with_pictures_flashcards.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0433/5150/7094/files/43453999847.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0440/8619/8424/files/61182627723.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0436/5395/5742/files/ejemplo_de_un_amef.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0434/8238/2502/files/37099994268.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0436/1895/9523/files/jiwije.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0440/4923/6118/files/bolozibopobaxidoji.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0438/6645/6224/files/kodigovonevuzajorelava.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006dae.bin
d5d65a9a2382db00d322947654ab4e59d05b5b52443a9ec72e2ed6ae70a8455a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6DAE 5524 bytes
font_01_sfnt_off00008060.bin
bbc1771cc3a30181a15173384fec9d4378dcf86a93ea920c9af327737c99cf13		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8060 10520 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.