Malicious PDF — malware analysis report

Static analysis result for SHA-256 5ee369b2f82c05c7…

MALICIOUS

PDF

47.6 KB Created: 2020-08-31 09:59:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 47a4874166ada19d2e44ae4848ac368a SHA-1: 03d482d05f2db164176cd7510fa36175f9030fbe SHA-256: 5ee369b2f82c05c7f09d769f6bf654b6063acb185db4eac5710cbb0f005a9f90
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains numerous links, with one critical heuristic identifying it as a malicious redirector pointing to 'ttraff.ru'. This URL is associated with a keyword search for 'rolling stone 500 greatest songs of all time pdf', suggesting a lure to a link farm or spam site. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=rolling+stone+500+greatest+songs+of+all+time+pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/mosagewenusuwaguxizekud.pdf
    • https://cdn.shopify.com/s/files/1/0429/5062/3385/files/sufefodivok.pdf
    • https://cdn.shopify.com/s/files/1/0433/3430/3912/files/12034427759.pdf
    • https://cdn.shopify.com/s/files/1/0428/6126/5062/files/54787790577.pdf
    • https://cdn.shopify.com/s/files/1/0438/4158/5314/files/rekotupo.pdf
    • https://static.usrfiles.com/ugd/b8c837_9f19f3f709c24505b265ac7d5dbada1b.pdf
    • https://static.usrfiles.com/ugd/b8c837_c9480f7a8b664adbb95a5b2b15bbd69b.pdf
    • https://static.usrfiles.com/ugd/4b68be_5d9e3e14a7954759ab2f667809c7eab2.pdf
    • https://static.usrfiles.com/ugd/4ae4db_f2588dd0f6aa403287d89b8b46fa77d1.pdf
    • https://static.usrfiles.com/ugd/4dd980_1aab35e7769d4314b4a4931daf3c21a0.pdf
    • https://static.usrfiles.com/ugd/3ceeb9_9ac30412dc43461e9de5c785586b9b61.pdf
    • https://static.usrfiles.com/ugd/b8c837_0a5455990fbc465ba8584713ff21f099.pdf
    • https://static.usrfiles.com/ugd/ee9d3f_13b5a299e1524f7dae7b7bc8f839161d.pdf
    • https://static.usrfiles.com/ugd/3b47cb_1f1a01bd602b4b0d927d5bc4da9846eb.pdf
    • https://static.usrfiles.com/ugd/b8c837_020fe300be4e4cbbadafe8ae2b3033d0.pdf
    • https://static.usrfiles.com/ugd/1fa6dd_f67ab1cba9984495a28455b5ea25b1b8.pdf
    • https://static.usrfiles.com/ugd/b8c837_278e3a57eae84c0eab8999e0be6f1c5e.pdf
    • https://static.usrfiles.com/ugd/8ba634_8f16dfb77dab4f8b8d87a12ac3ae6785.pdf
    • https://static.usrfiles.com/ugd/3ab5ed_a489fa5821d64e82b54717197272d124.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000753c.bin
fbab6ac5d9138a16a0ad1f00748faa49720c64578b872fa09dd7b7af7335900c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x753C 5632 bytes
font_01_sfnt_off00008855.bin
b16dbc65206dede4dc833bc69e0d0a0c41baf18d9f4016238760d698edd1af2b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8855 12672 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.