Malicious PDF — malware analysis report

Static analysis result for SHA-256 626a3354190d3133…

MALICIOUS

PDF

46.3 KB Created: 2020-08-30 21:26:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 44140f8ee0703ac13b2615139f5131e9 SHA-1: 1f765badb214352b639b8457a5312d3c1eae8dbd SHA-256: 626a3354190d3133d1faaf59a0a565902e242a4c125d3d2d6cd64d996275e0a4
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links, many of which point to external PDF files hosted on Shopify and other domains, forming a link farm. One prominent URL, https://ttraff.cc/wix?keyword=grinding+machine+project+report+pdf, is identified as a malicious redirector. The document body, though heavily obfuscated, also contains this URL, suggesting an attempt to lure users to malicious infrastructure under the guise of a project report.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=grinding+machine+project+report+pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0433/4488/7966/files/50860478966.pdf
    • https://cdn.shopify.com/s/files/1/0431/9015/7473/files/8938982321.pdf
    • https://cdn.shopify.com/s/files/1/0437/9970/7810/files/44157005260.pdf
    • https://cdn.shopify.com/s/files/1/0430/5358/0437/files/dell_inspiron_15_driver.pdf
    • https://static.usrfiles.com/ugd/98857b_006dc2b4385e4047b943ea5f59df15c9.pdf
    • https://static.usrfiles.com/ugd/b8c837_169ef3c8b5bf44cd98003b3c48c365e9.pdf
    • https://static.usrfiles.com/ugd/e73fea_313c5f23230a47a9a89a68d71b5cefb9.pdf
    • https://static.usrfiles.com/ugd/2f7815_8340bb5e4be541609f3e6df9e38ee9d6.pdf
    • https://static.usrfiles.com/ugd/2f3ac6_8fc655d4e4b04a38b2acd7c6db275fcc.pdf
    • https://cdn.shopify.com/s/files/1/0433/2571/8678/files/free_online_template_for_resume.pdf
    • https://cdn.shopify.com/s/files/1/0434/7763/1126/files/how_to_calculate_grade_in_excel_2020.pdf
    • https://cdn.shopify.com/s/files/1/0429/0487/9271/files/8307522087.pdf
    • https://cdn.shopify.com/s/files/1/0429/1425/0905/files/english_short_stories_easy.pdf
    • https://cdn.shopify.com/s/files/1/0447/7868/4573/files/50200458176.pdf
    • https://static.usrfiles.com/ugd/b8c837_0e384b9c7a9c4e21b02b4c9a1b75ccd0.pdf
    • https://static.usrfiles.com/ugd/dad90e_95964c06ed6d4d7d84a5eb3f04260a0a.pdf
    • https://static.usrfiles.com/ugd/b8c837_3a157940a3f544febec2083513d0072b.pdf
    • https://static.usrfiles.com/ugd/98857b_1877c8a1c5654c0b882d6a8bc2124d19.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000779e.bin
aaeb5cafb2397e83c66404370c13e3b7881297d868254a881e848233822f642f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x779E 5468 bytes
font_01_sfnt_off00008a0f.bin
237991d1a724a87d45f48fcd064dcb694a7e0ff17c2eaf9b4ddb393e3bf296dd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8A0F 9920 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.