Malicious PDF — malware analysis report

Static analysis result for SHA-256 660e23cf4204063f…

MALICIOUS

PDF

40.8 KB Created: 2020-08-31 05:21:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b124a2444252c27192202d321d3ab133 SHA-1: 43d8734c352f5ee6d06ab97aca3cd8b450f16d06 SHA-256: 660e23cf4204063fd7cb6d9b96945e2bfae95eee232367448809b703143ae2e6
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains embedded URLs and a document body that mimics a service manual, aiming to trick users into clicking malicious links. The heuristic PDF_MALICIOUS_REDIRECTOR_LINK specifically identifies a link to ttraff.com as malicious, which is likely used to redirect users to a phishing or malware distribution site. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=fantom+cyclone+xt+service+manual
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://cdn.shopify.com/s/files/1/0437/0956/3045/files/john_wick_download.pdf
    • https://cdn.shopify.com/s/files/1/0433/0638/5573/files/78059329893.pdf
    • https://cdn.shopify.com/s/files/1/0432/0280/5921/files/wifuzasebevudoniwurajime.pdf
    • https://cdn.shopify.com/s/files/1/0434/8814/9668/files/mulesesoxovexazajusezo.pdf
    • https://cdn.shopify.com/s/files/1/0429/6690/9081/files/plasma_membrane_and_cell_transport.pdf
    • https://cdn.shopify.com/s/files/1/0435/2190/0696/files/boswellia_serrata_monograph.pdf
    • https://cdn.shopify.com/s/files/1/0431/1715/0368/files/zaxugijupazenerusud.pdf
    • https://cdn.shopify.com/s/files/1/0430/1501/2511/files/jci_accreditation_standards_for_hospitals_5th_edition.pdf
    • https://cdn.shopify.com/s/files/1/0427/8091/7926/files/wuvulusolaxedigefij.pdf
    • https://static.usrfiles.com/ugd/bfbc46_ddc00f3089a44cd8b6327f737f4c4fc8.pdf
    • https://static.usrfiles.com/ugd/33a2e4_faa59bb0a64f4321b587e804c53e7653.pdf
    • https://static.usrfiles.com/ugd/868401_d70e68bc628e479ab8b8ad1c8dd4cf84.pdf
    • https://static.usrfiles.com/ugd/de3d83_ce1b83e5537046758bbaf8eef56f00ab.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005602.bin
14399b0d157fe041095b4cb69f7deb7fa8a178245a5371e132553d594fbac8dc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5602 5012 bytes
font_01_sfnt_off000066ff.bin
bc0e2c2bd72575298560d44bd736b4fb0ea2cbdc24a3f41f04306272539b54c1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x66FF 9748 bytes
font_02_sfnt_off0000885a.bin
ce7e2e230a41ba6fc2d7d2240890c8289d67876d84a3d076d67c0b48111c8230		 pdf-font-stream PDF embedded font (sfnt) at offset 0x885A 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.