Malicious PDF — malware analysis report

Static analysis result for SHA-256 6a5e5cfa1ce7e335…

MALICIOUS

PDF

55.2 KB Created: 2020-09-16 18:58:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8112e5549cb882ca55489241c85f4b1d SHA-1: 224ed0ab8939cb6613faa926b84c33a5f0918f05 SHA-256: 6a5e5cfa1ce7e335098195f15836845c73d2892039b35444528b78ca98ad6dbf
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links, many of which point to a link farm designed to manipulate search engine results. One prominent URL, https://ttraff.club/wix?keyword=online+tax+comparison+2020+vs+2021, is identified as a malicious redirector. This suggests the document's primary purpose is to redirect users to malicious infrastructure, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/wix?keyword=online+tax+comparison+2020+vs+2021
    • http://files.onelinerjokelab.com/uploads/1/3/1/3/131381411/gosenewoxo_ketegakeses.pdf
    • http://files.thecoachmensclubhouse.com/uploads/1/3/0/7/130738696/volofekabi-sepaxajokulejok.pdf
    • http://files.seetheworld.tours/uploads/1/3/2/8/132815961/bawifutopite.pdf
    • http://winosav.jeanettebroxmccarthy.com/uploads/1/3/1/6/131607600/vogojigigubatipi.pdf
    • http://jijuj.missouri-al-anon.org/uploads/1/3/2/6/132682883/1572882.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://f6e319a4-713a-483d-b235-f73977ff8f3b.filesusr.com/ugd/974a4e_5a74700a305941d9a01613f9387fe289.pdf?index=true
    • https://445e3b32-74e3-4f57-82a4-ac988050d83f.filesusr.com/ugd/fb5067_8eaaff10246a4bb5bff4029d2e4ebfae.pdf?index=true
    • https://d925ee49-a3ce-4804-a531-70f38f3656bf.filesusr.com/ugd/f1780b_eb0f3ffe94e74e4ea8b8b95ee6e365a7.pdf?index=true
    • https://94a51085-16d8-43e8-8a7b-9afcb2cb2a44.filesusr.com/ugd/3f8d85_332f7b792ea248568c7c91cbc6b72c42.pdf?index=true
    • https://ff1a5fff-94d6-40e9-a49f-7c53d92d551d.filesusr.com/ugd/c844bf_1bc71e3397554f558dc819a24bfa4c44.pdf?index=true
    • https://79af0977-8ad5-4680-9ddd-c3e9887f165b.filesusr.com/ugd/3a38e0_50a9b945ce4e4e339d8dfdaa9736acb7.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007937.bin
2f6456ef78ccdbceb11e9e273034f818d00daa917a8aa478b17df45e2ace8fb8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7937 5560 bytes
font_01_sfnt_off00008c11.bin
d3f386aac4cb9220b971c36342e3e2e8cf07832724da5e9819a8e09c6d984b08		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8C11 14912 bytes
font_02_sfnt_off0000bac4.bin
6e3fbd491d8b71441998836ddca0d0c102716a221ea14f8143929167ad9a79b3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xBAC4 16164 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.