Malicious PDF — malware analysis report

Static analysis result for SHA-256 5ac63f936e30db5c…

MALICIOUS

PDF

40.7 KB Created: 2020-08-30 08:15:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 28c5e7a201e0a5d7803f4a5fff83efcb SHA-1: 27f73ef649f6aa2dcad782b8e1a204e28f889ba7 SHA-256: 5ac63f936e30db5c466c1b4fbdcc1491766c680f4f57e0819bf663da03f20d34
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains embedded links, with one identified as a malicious redirector. The ML classifier strongly flagged this PDF as malicious, and the presence of numerous external links suggests a link farm or SEO poisoning attempt. The primary malicious URL identified is https://ttraff.ru/wix?keyword=boston+basher+tf2, which is likely used to lure victims into a phishing or scam operation.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=boston+basher+tf2
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://static.usrfiles.com/ugd/08fe48_60e180ae0ddc472499d81a5918cde0e2.pdf
    • https://static.usrfiles.com/ugd/de3d83_ae1c01636cb14d4c87be6e2f1be3110b.pdf
    • https://static.usrfiles.com/ugd/1cfe37_3f3d04cbe683439886181a086d04d3eb.pdf
    • https://static.usrfiles.com/ugd/b8c837_9586012e658f4a18b04395e18214053e.pdf
    • https://static.usrfiles.com/ugd/8de238_ade707d23e4f492ba01da48f275f4f8e.pdf
    • https://cdn.shopify.com/s/files/1/0437/3633/4501/files/62305430172.pdf
    • https://cdn.shopify.com/s/files/1/0431/6397/5835/files/zijarosopob.pdf
    • https://cdn.shopify.com/s/files/1/0436/0696/6429/files/sitekamuvutizoj.pdf
    • https://cdn.shopify.com/s/files/1/0437/0323/8811/files/fukogubewafonur.pdf
    • https://cdn.shopify.com/s/files/1/0439/3933/2251/files/gregg_reference_manual_10th_edition.pdf
    • https://static.usrfiles.com/ugd/5438e3_d6fd36039a304b18b2372f3479f5a3a2.pdf
    • https://static.usrfiles.com/ugd/0047a4_b0201be3d7984ca4b8904426166bded3.pdf
    • https://static.usrfiles.com/ugd/b8c837_e7925511cda94b2ca2e78fdb48f63a16.pdf
    • https://static.usrfiles.com/ugd/451461_10385fce17b84652b25ae7c3da298348.pdf
    • https://static.usrfiles.com/ugd/ecec20_0ae689a084364fef91881f1094560318.pdf
    • https://static.usrfiles.com/ugd/ec0c41_a887d98c0a4f4b04a0c3b19620d3c6a1.pdf
    • https://static.usrfiles.com/ugd/b8c837_396a42f591524d1b83156bef42351dca.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005f57.bin
71673e0d683b63e0ccf2283da2a8e48f91dbc5c2103b14b27d93f70ce3c434c8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5F57 5144 bytes
font_01_sfnt_off000070cc.bin
78d6cd664b0967febbcdf267e05f95af28f2376916b8bd023f850cb99daffc5b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x70CC 10928 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.