Malicious PDF — malware analysis report

Static analysis result for SHA-256 4cba0b70e61e3425…

MALICIOUS

PDF

41.9 KB Created: 2020-08-30 08:17:19 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 095fdf94c2cceb9e408d95cff8e62a29 SHA-1: c89f7fb597bce75d4bb8966978c8bc73fbe9a2fb SHA-256: 4cba0b70e61e3425c53ac88e7b90a9d6fbcbebe8d18a19cff42bd1480921a966
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a link that redirects to a known malicious domain, ttraff.com. This domain is associated with redirecting users to further malicious content. The document body, though heavily obfuscated, contains the same lure text as the malicious URL, suggesting a social engineering attempt to trick users into clicking the link. The PDF also contains a large number of links to external PDFs, likely for SEO manipulation to improve search engine ranking for the malicious lure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=go+ho%2527s+starry+night+episode+1+eng+sub
    • https://static.usrfiles.com/ugd/b8c837_832aecef188b4b538cd4dcace800634b.pdf
    • https://static.usrfiles.com/ugd/8a419d_b4a18fad1c254b7b850f1babb1ffbb2b.pdf
    • https://static.usrfiles.com/ugd/20d83a_108220203b144f7baad33188d9bea6c4.pdf
    • https://static.usrfiles.com/ugd/b8c837_b240dd75caa84d1f8ed42af41277e259.pdf
    • https://cdn.shopify.com/s/files/1/0432/1699/4466/files/62080265209.pdf
    • https://cdn.shopify.com/s/files/1/0434/5951/0424/files/anonymous_browser_free.pdf
    • https://cdn.shopify.com/s/files/1/0434/5892/0605/files/list_of_helping_verbs_in_english.pdf
    • https://cdn.shopify.com/s/files/1/0463/4856/6690/files/59562734146.pdf
    • https://cdn.shopify.com/s/files/1/0459/1992/8469/files/vejigantes_obra.pdf
    • https://static.usrfiles.com/ugd/6f58fb_1ef5fb1cb864469b8233aab741ba3b5a.pdf
    • https://static.usrfiles.com/ugd/b8c837_5e124e27a9ad40eaa2c231729b4f7778.pdf
    • https://static.usrfiles.com/ugd/b8c837_2c72998f81a24045ab070bbb986368ff.pdf
    • https://static.usrfiles.com/ugd/a382ee_f28e3598198c4e5fa4ee06d49067044c.pdf
    • https://static.usrfiles.com/ugd/238140_c03835010c8b407f9e25da3dd348da3e.pdf
    • https://static.usrfiles.com/ugd/6240f8_2f7c44c4196d4d299a19e2ef8b2d6cb1.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000044a9.bin
17112d18d6f00a5c0d91d5e4f927f75cdd6597549e37f823e290b6f5e1e5924c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x44A9 6216 bytes
font_01_sfnt_off00005a59.bin
fb3ba1ac560aba0727c344863dd0ee500b8ebb4515c5feb379e4dee5d2103982		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5A59 5432 bytes
font_02_sfnt_off00006cd6.bin
327a5da18e9a06832ab253af3a557a59a6563b997b054d3dfe523388492d85ce		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6CD6 9072 bytes
font_03_sfnt_off00008bc2.bin
d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8BC2 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.