Malicious PDF — malware analysis report

Static analysis result for SHA-256 62d6dc358ce94c29…

MALICIOUS

PDF

33.2 KB Created: 2020-11-03 04:50:51 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-26
MD5: c23bbd272a4eb4d5667761b10f42bd37 SHA-1: 7633602b0d02697c865afac690cfc0780f1c4dd7 SHA-256: 62d6dc358ce94c29b64a651a3fefef65397481f36e3676cb733bda1079d62034
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link to a known malicious redirector, ttraff.ru, which is presented with a keyword suggesting a game hack. The PDF also exhibits characteristics of a link farm, with numerous external links, many pointing to Weebly and Shopify domains. The ML classifier strongly flagged this PDF as malicious, supporting the conclusion that it is designed to redirect users to harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/123?keyword=sands+of+the+coliseum+hacked+arcadeprehacks In PDF document text
    • https://debasomi.weebly.com/uploads/1/3/0/7/130739769/81fc7.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4414873/normal_5f998906cab63.pdfIn PDF document text
    • https://migabodunezo.weebly.com/uploads/1/3/4/5/134587819/musekatuzegowi.pdfIn PDF document text
    • http://www.myhappygames.com/game/294...-Coliseum.htmlIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://cdn.shopify.com/s/files/1/0501/6361/3853/files/kurik.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0484/5931/7398/files/csr_racing_2_hack_ios.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0480/3346/4479/files/the_hunger_games_book_3.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0486/8669/4550/files/saul_alinsky_rules_for_radicals_book.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0431/5440/7578/files/summoners_war_account_lookup.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0266/9291/1273/files/p_launcher_for_android_9.0_apk.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0496/4057/1029/files/rijukomewiwisore.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0435/2416/1704/files/the_round_table_topic_the_qin_and_han_dynasties_worksheet_answers.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0498/5529/9750/files/present_and_past_participle_test.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0480/5322/3588/files/tiviganipebawuvimofinuve.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000436a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x436A 5560 bytes
SHA-256: 5330e82ba6d46a33eef8fe00816821bb5c1ddb521c4d18bf9e6b7191f44b742a
font_01_sfnt_off0000562b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x562B 9940 bytes
SHA-256: 698031335c97710ecafda497e4495501da3b5be9cffb7790b28714a2971d3639

Open this report in the interactive analyzer, or submit your own file for analysis.