Malicious PDF — malware analysis report

Static analysis result for SHA-256 3fed0e222a23ebfa…

MALICIOUS

PDF

39.7 KB Created: 2020-09-19 18:45:19 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: aeecda8980029f34e5094d5ec8edb6d1 SHA-1: d7f997ca6b889bf35c3fbac66a91f01fb63a597a SHA-256: 3fed0e222a23ebfaf037e853154c8b0221529c186754aa6210258b13df00b9a1
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a significant number of embedded links, a common tactic for SEO poisoning and redirecting users to malicious sites. One of the embedded URLs, 'https://ttraff.club/wix?keyword=map+of+breland+eberron', is identified as a known malicious redirector. The presence of numerous links suggests an attempt to lure users into clicking through to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/wix?keyword=map+of+breland+eberron
    • http://files.ladolcevitadairygoats.com/uploads/1/3/1/4/131437444/batifezibi-fosesimipik-kofamadojor-vafevovuta.pdf
    • http://lobotu.equityfinancetaxservice.com/uploads/1/3/1/8/131856726/c2340b59f908a.pdf
    • http://zeromox.pilgrimlutheranfreedom.com/uploads/1/3/1/4/131437774/jobafunigelopak.pdf
    • http://fatof.lauraguayartclass.com/uploads/1/3/1/6/131606469/biwaresezajeme.pdf
    • https://72a6b7a2-3352-43df-b1aa-a8b42f7f2e49.filesusr.com/ugd/96a426_b088fcab52024cb3998a62d03fd118f3.pdf?index=true
    • https://4780be77-c390-48a0-92c4-784112516ea0.filesusr.com/ugd/921909_4eacd50f47714bf8ad401df7471f22c4.pdf?index=true
    • https://cb091db7-92e5-41d5-bb5d-cb88ca3ab0fb.filesusr.com/ugd/bc79a4_89f9f626aa734ea0af6fdc4bd2154b22.pdf?index=true
    • https://701aa016-7bfe-4ad3-b5f0-2388b203e8e3.filesusr.com/ugd/27135d_2bc5fd235f4445949ad535d6de03bebb.pdf?index=true
    • https://b0302baa-7acc-4199-92a4-024e18c0328b.filesusr.com/ugd/1a89c8_d040480e4555402c8bddb9b47e587fec.pdf?index=true
    • https://fc1a300b-bf62-4c85-bf74-d84e3a34a214.filesusr.com/ugd/54fa57_940cf3a6875741dca028b726cb899eaa.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005dfd.bin
4f3deb6b39398bd37664e9aa004d96975f38c86e1a5c759f03c53b41e270dd57		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5DFD 5000 bytes
font_01_sfnt_off00006f14.bin
89d07e416469ae4277013567d39ded0ada9f152fd9b376556e917cb0d083dc92		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6F14 10420 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.