Malicious PDF — malware analysis report

Static analysis result for SHA-256 689d8834d63fad58…

MALICIOUS

PDF

44.2 KB Created: 2020-10-05 22:20:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: be5bb963296fdd637ca59728eaa7795b SHA-1: 4731ae0de1264cafea55b5b4ce4d27bf72c2d2da SHA-256: 689d8834d63fad5813efb80dfadad9bed6b569dc2854d0f549938da2ad0f4d6e
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link to a known malicious redirector, ttraff.me, which is designed to lead users to malicious content. The document body, though heavily obfuscated, contains the same URL and appears to be a lure related to 'Johnny Ace WWE net worth'. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/pify?keyword=johnny+ace+wwe+net+worth
    • https://site-1039279.mozfiles.com/files/1039279/rapawapuwurusajikilitaze.pdf
    • https://site-1037077.mozfiles.com/files/1037077/76981924548.pdf
    • https://site-1044071.mozfiles.com/files/1044071/48262843039.pdf
    • https://site-1038971.mozfiles.com/files/1038971/gupidozato.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/e396e96e-c8e0-4a2f-ba84-7d6c5d22bdff/gomifusozirixezuj.pdf
    • https://uploads.strikinglycdn.com/files/c5e31c7e-0157-479e-acc1-344c9c2ac7b5/mejugetapenem.pdf
    • https://uploads.strikinglycdn.com/files/a8e4cbd7-d77e-4178-8479-db2bd39db6bc/xisodegekasola.pdf
    • https://uploads.strikinglycdn.com/files/6176a046-53cb-4bd1-b108-f3a964796b89/fanudexewogovilatedoju.pdf
    • https://uploads.strikinglycdn.com/files/06bc9e13-6833-439d-9f70-864bf2b12ff4/5530990228.pdf
    • https://uploads.strikinglycdn.com/files/d8f9d347-fa44-48b6-907b-ad468ad7f97a/77911113337.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005933.bin
0e0e98a9724f675cf5781ba5eafb10cd86a84d8bece9799f279b79da7fa79f85		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5933 4860 bytes
font_01_sfnt_off000069d1.bin
06de266c73bee8ca3a3c65dc4a0433b0be2d7f7a26e620a2a570511ee518a77d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x69D1 10764 bytes
font_02_sfnt_off00008ecf.bin
8c1e3298cb301b6aa2c2aeff0a89e1cafee6626e56d5ffa98ad52a7598c40df9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8ECF 16168 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.