Malicious PDF — malware analysis report

Static analysis result for SHA-256 5870ccba01e04468…

MALICIOUS

PDF

49.2 KB Created: 2020-09-05 12:55:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-17
MD5: cfcc4c1a9ec20fef82b48aaccb30ae1f SHA-1: 9fc6bbca777b9f1b99d5fda670ec39337d32b577 SHA-256: 5870ccba01e04468fb38d5a45aa97f06e139acdcda5ba3ff4e5ebfb5ca95e343
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous links to external PDFs, masquerading as a document about the 8086 microprocessor. One of these links, https://ttraff.cc/wix?keyword=bus+interface+unit+of+8086+microprocessor+pdf, points to known malicious redirector infrastructure. The ML classifier also strongly indicated maliciousness. The document body itself is heavily obfuscated and contains the malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=bus+interface+unit+of+8086+microprocessor+pdf In PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://static.usrfiles.com/ugd/b8c837_f8f0a6fa93dd4babb76a95e8490c82dd.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/808d8c_5225ceffb4fc408f8536b41bff46ba4c.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/b8c837_8e164a86fdb949f591a5c04cb45f2010.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/93971e_a97e2804c5a047258062d7472d650ef4.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/0c268c_bb506a59baaf44d299185e04fcbcf17f.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/166c09_2d6cb695cbb44be699c74b22e5054ff8.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/d9f7b5_f9190374299f4b168a10903834eff422.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/585b1d_f6424690991647d185b92ce476dba051.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/c7a620_abc2c35cc55644f9b672b91c6587f025.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/b8c837_ddcf71396a3c463a99180d85e72960ff.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/a64c8c_cd9f8e364f0547598459fefa33bc3dea.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/7be1cd_7385ffbeac5a4268b4895a994fbca4aa.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/2b25b5_ece4b52cb680405db45c0766d985b45d.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/5bb01c_fabfa0f48558469181ad5341b823ddfd.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/2ac701_d9bea7f73081476fb310ad6c5df8245e.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/e4ff69_16e1d2c8d580453a8579e3cc96ff6596.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/fa32a6_bfb89ed1d81f4850bd1fed43480d0c0c.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000080a3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x80A3 5808 bytes
SHA-256: 89903995d0d52aab70995c84d786b380a3e1cf243b11a3a406ece14c7550c121
font_01_sfnt_off00009447.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9447 10300 bytes
SHA-256: 2efa17b1b6261a66bde9dba3a3d4fc8039c218ac5d76a0a24006f6398156f82a

Open this report in the interactive analyzer, or submit your own file for analysis.