Malicious PDF — malware analysis report

Static analysis result for SHA-256 65c2ea6569fa428c…

MALICIOUS

PDF

37.9 KB Created: 2020-09-02 00:42:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e945a1da0227704e9109f4184d7d239f SHA-1: f33ba88ecc016fcdea321866814988407e3c1756 SHA-256: 65c2ea6569fa428c69b9108dc2d80ea60372f5c211c25b614de317467e98b153
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a large number of embedded links, many of which point to a link farm designed to redirect users to malicious infrastructure. The primary redirector URL identified is https://ttraff.com/wix?keyword=forces+worksheet+tes. This behavior is indicative of a phishing or malicious redirection scheme, likely intended to lead users to further malicious content or exploits.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=forces+worksheet+tes
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://static.usrfiles.com/ugd/b8c837_03cd2da1f9fc42399650b944f5b7e15d.pdf
    • https://static.usrfiles.com/ugd/217b8a_95a7b3723c8443cabedbab3d51dc94cc.pdf
    • https://static.usrfiles.com/ugd/b98abb_e9c18d81ab5f4fef8e2d9dc203ff7705.pdf
    • https://static.usrfiles.com/ugd/b8c837_87138a1d72a24928a626ab6d5ac58bec.pdf
    • https://static.usrfiles.com/ugd/9ea9b6_004d8cebf92c475c9718d105e0c61936.pdf
    • https://static.usrfiles.com/ugd/b8c837_cc49fc282ce94bc688b41131689e017e.pdf
    • https://static.usrfiles.com/ugd/ef253e_baeed0d2d7a04e7bae73c9562b554b82.pdf
    • https://static.usrfiles.com/ugd/0cd3a8_fe9c5b5c7cdc4ff49d685a2307651794.pdf
    • https://static.usrfiles.com/ugd/b8c837_a75d2d016c50462fa806556b74d8bc4e.pdf
    • https://cdn.shopify.com/s/files/1/0433/0763/0747/files/19984052184.pdf
    • https://cdn.shopify.com/s/files/1/0435/2586/5636/files/participle_adjectives_advanced_exercises.pdf
    • https://cdn.shopify.com/s/files/1/0433/0881/0398/files/fionna_and_cake_episodes.pdf
    • https://cdn.shopify.com/s/files/1/0431/7095/5424/files/nanirowezi.pdf
    • https://cdn.shopify.com/s/files/1/0433/3957/9546/files/jinopemexubon.pdf
    • https://cdn.shopify.com/s/files/1/0427/9320/5916/files/59005261378.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/nofalefupipalivudekim.pdf
    • https://cdn.shopify.com/s/files/1/0431/5391/6053/files/grammarly_for_word_2007.pdf
    • https://cdn.shopify.com/s/files/1/0433/6635/0998/files/mosoworoxa.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000594d.bin
16c53076ef212c77d4ecfd597159ba07bcc1922fc1fb1869e4cd2ff36df6df69		 pdf-font-stream PDF embedded font (sfnt) at offset 0x594D 4756 bytes
font_01_sfnt_off0000698e.bin
6853fdf9ef8a2c92087c56389ddbef2a3d1a315ff1dfd4ba90b76d06c0fa36ca		 pdf-font-stream PDF embedded font (sfnt) at offset 0x698E 9652 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.