Malicious PDF — malware analysis report

Static analysis result for SHA-256 33ea514e49d37131…

MALICIOUS

PDF

38.0 KB Created: 2020-08-09 16:33:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 86d08034dd6f3d32518e476d2ca73d7a SHA-1: 1451e39266a7989c9af90467d2f6736821029bcf SHA-256: 33ea514e49d3713158cf62467d5c23ff6a8b0e63c20a04e9f5dc93dade0e8197
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded links, with one specifically identified as a malicious redirector pointing to 'ttraff.com'. This redirector is likely used to obscure the final destination, which is probably a phishing or malware distribution site. The presence of a large number of external PDF links suggests a link farm designed to improve search engine ranking for malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=wings+of+fire+book+6+pdf
    • http://palupexo.rmcustompaintanddecal.com/uploads/1/3/2/3/132303382/dokumefujedo.pdf
    • http://dubewopa.worldofchristinestoddard.com/uploads/1/3/0/8/130873995/midozimetezoka-xuxaradi-xexopodelewinat-tugomadudupo.pdf
    • http://files.kcbeast.com/uploads/1/3/1/0/131069824/1fa9a92c44603c1.pdf
    • http://files.themuaythaimuppets.com/uploads/1/3/1/8/131856624/funedafepame.pdf
    • http://files.campconcordia.net/uploads/1/3/0/8/130874122/xigoja.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://cdn.shopify.com/s/files/1/0433/9728/3996/files/40448764828.pdf
    • https://cdn.shopify.com/s/files/1/0431/6718/7108/files/66500976861.pdf
    • https://cdn.shopify.com/s/files/1/0448/1895/6448/files/pathfinder_kingmaker_artisans.pdf
    • https://cdn.shopify.com/s/files/1/0434/6917/6985/files/wekigudofajat.pdf
    • https://cdn.shopify.com/s/files/1/0432/8125/2512/files/xewuzogexot.pdf
    • https://cdn.shopify.com/s/files/1/0432/3885/0719/files/76012625908.pdf
    • https://cdn.shopify.com/s/files/1/0440/1872/9125/files/industrial_ammonia_refrigeration_cycle.pdf
    • https://cdn.shopify.com/s/files/1/0432/6588/4313/files/bosugepenuxum.pdf
    • https://cdn.shopify.com/s/files/1/0432/7813/9556/files/dolik.pdf
    • https://cdn.shopify.com/s/files/1/0432/7584/5792/files/76849885287.pdf
    • https://cdn.shopify.com/s/files/1/0435/3759/6575/files/83169051043.pdf
    • https://cdn.shopify.com/s/files/1/0433/9925/0072/files/17968730602.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004a8f.bin
56e249bfd2bef3a068d34d9cf22353d4701bd2b4090ef07ed5a706b5fa89aee1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4A8F 5048 bytes
font_01_sfnt_off00005bc4.bin
d7f5dfc6feb0cdbb23f6aac73855f111cffd4ca72639baeefc127c0bb221de22		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5BC4 9676 bytes
font_02_sfnt_off00007ced.bin
9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7CED 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.