Malicious PDF — malware analysis report

Static analysis result for SHA-256 18f95791fb4836ed…

MALICIOUS

PDF

48.2 KB Created: 2020-08-14 19:24:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e52e7a7a6435246194ab6b2645dffdf0 SHA-1: 200433287d2eecbbb65442eb3d064c38cdcb81c7 SHA-256: 18f95791fb4836ed7301539a6421ad0d1a004e5e804c8940e9773fc28faf0ecf
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links, many pointing to Shopify domains, but one critical link to 'ttraff.com' is flagged as a malicious redirector. The ML classifier also strongly indicates maliciousness. The document body, though heavily obfuscated, contains the malicious URL and appears to be a lure related to Excel formulas, suggesting a phishing or scam attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=formule+excel+pour+arrondir+au+dessus
    • http://files.pn-projectmanagement.com/uploads/1/3/1/3/131379615/xezugeme.pdf
    • http://files.johnnocasson.co.uk/uploads/1/3/0/8/130814596/4354478.pdf
    • http://files.personalspaceproject.com/uploads/1/3/2/7/132740343/piwepapefa-kavijabojexopi-fuwuwumewa.pdf
    • http://jajuzasid.missbilovsky.com/uploads/1/3/1/8/131856333/6764770.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0438/3988/1373/files/37692635043.pdf
    • https://cdn.shopify.com/s/files/1/0438/9994/5112/files/61445475845.pdf
    • https://cdn.shopify.com/s/files/1/0429/6779/3817/files/50_sombras_de_grey_libro.pdf
    • https://cdn.shopify.com/s/files/1/0431/5119/6314/files/99142237672.pdf
    • https://cdn.shopify.com/s/files/1/0430/1013/0073/files/95536413796.pdf
    • https://cdn.shopify.com/s/files/1/0447/5600/9111/files/vokerunonigoko.pdf
    • https://cdn.shopify.com/s/files/1/0435/8701/0715/files/jovaverenofikarab.pdf
    • https://cdn.shopify.com/s/files/1/0438/0426/2561/files/61970504357.pdf
    • https://cdn.shopify.com/s/files/1/0428/2885/7503/files/21490978419.pdf
    • https://cdn.shopify.com/s/files/1/0443/1478/7996/files/tutorials_on_python_programming.pdf
    • https://cdn.shopify.com/s/files/1/0427/5381/8790/files/wifigizitef.pdf
    • https://cdn.shopify.com/s/files/1/0431/3966/1981/files/greenhouse_effect_for_students.pdf
    • https://cdn.shopify.com/s/files/1/0440/6562/0118/files/feels_so_good_sheet_music_tabs.pdf
    • https://cdn.shopify.com/s/files/1/0434/5203/9324/files/vesiguxudateris.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006446.bin
75d409d08999c8afeb49fa5c51c04363999c2d6ef7cea04acd65a8980bfc6392		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6446 5240 bytes
font_01_sfnt_off00007605.bin
bea21e68b02449fe65e36241858b3ff5031c6c8e8ebc89c7fcfd7d3b7c041d66		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7605 11676 bytes
font_02_sfnt_off00009b6d.bin
e42a7cccdef6191b2f49fe77108a37ab8c99e108ccc0a243006331e5fc5aa57d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9B6D 16656 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.