Malicious PDF — malware analysis report

Static analysis result for SHA-256 58ed0ea1912bd07e…

MALICIOUS

PDF

58.7 KB Created: 2020-10-30 22:25:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: b71b773757b05fed96d2af9d71a8395a SHA-1: 94ac8a18590d8351b95267de3d4837f19bff6c13 SHA-256: 58ed0ea1912bd07ef74a499212622682608ff78980c791ad5ed38f9fe0fac8e0
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a heuristic firing for a malicious redirector link, which points to the URL https://ttraff.me/123?keyword=royals+seating+chart+with+rows. The ML classifier also flagged this PDF with high confidence. The document body, though heavily obfuscated, contains the same malicious URL, suggesting the primary intent is to redirect the user to a potentially harmful site.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/123?keyword=royals+seating+chart+with+rows In PDF document text
    • https://cdn-cms.f-static.net/uploads/4382406/normal_5f9195fdd4abb.pdfIn PDF document text
    • https://dujibirarikow.weebly.com/uploads/1/3/4/3/134321406/9494033.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4381531/normal_5f8d2a154e7fa.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4388289/normal_5f9c028b5d2b5.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://cdn.shopify.com/s/files/1/0496/1838/7107/files/genesis_mountain_bike_walmart.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0499/8365/1990/files/13601638860.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5c6e7fbe-fed6-4c5e-87e6-38673e5c9c91/kenmore_ultra_wash_dishwasher_filter.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0438/0711/3373/files/xagelefefojeguwef.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5a8b6fa1-2698-44b6-a3d8-55658767e5ae/read_the_skylighter_online_free.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0498/4864/7835/files/obra_de_teatro_para_nios_cortas.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0429/0324/0871/files/intuition_and_analytical_chess.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00009047.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9047 5260 bytes
SHA-256: 4e5ba3c827933abaf97144d4cfc2f269d42c3749934dd7f9be5c75d0e929031d
font_01_sfnt_off0000a246.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA246 11360 bytes
SHA-256: e27f699b6653bb1d5c40895f64eadfc84bc7e4dafd73b6aae41d67713763cde2
font_02_sfnt_off0000c8c6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC8C6 16092 bytes
SHA-256: 39b2f4b99ee08965fd4836f89f628a00cde8346cb181131bba0308e80db8fb67

Open this report in the interactive analyzer, or submit your own file for analysis.