Malicious PDF — malware analysis report

Static analysis result for SHA-256 6de0d1c610c35162…

MALICIOUS

PDF

156.3 KB Created: 2020-09-18 23:15:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1622389af473532b9a738710939ee095 SHA-1: 1696c4d08dc5c341d4a4b828c1985e0683d78c1c SHA-256: 6de0d1c610c35162f2b458555d090c14b55873a9489af44e2defcc0cf3f3476e
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and contains a critical heuristic indicating it links to known malicious redirector infrastructure. The embedded URL 'https://ttraff.club/wix?keyword=rsync+link-dest+relative+path' is presented as technical content, likely a lure to trick users into clicking it. The presence of embedded URLs and the malicious redirector link strongly suggest this document is part of a phishing campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/wix?keyword=rsync+link-dest+relative+path
    • http://rufitine.llanrhaeadrgardeningclub.com/uploads/1/3/1/4/131452976/xatanebonavuxiv_fuzurotobanajib.pdf
    • http://sojopije.ohmyluxo.com/uploads/1/3/2/3/132303163/ginelavulup_sowubunipibe_xuxuz_ligodofimumaw.pdf
    • http://files.shurburtt.com/uploads/1/3/0/9/130969503/xatipumijatuj.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://e9fd689a-b4f4-4002-a5cc-f2057a3b1a13.filesusr.com/ugd/f523c3_f222f2ed7b8f43d9a0ba443724aa1d84.pdf?index=true
    • https://c9e91cc9-3d44-411f-8581-f96e43b1a019.filesusr.com/ugd/5926b4_f22cb533c11b4994be61d4dba3536be3.pdf?index=true
    • https://8af9ddcb-35fa-46ba-a6b1-0272416971ec.filesusr.com/ugd/daca0d_40b2a90f61de4d769a31c259f9f0a0b0.pdf?index=true
    • https://037eca1b-d2e6-4215-8b36-56940a6ffffb.filesusr.com/ugd/173616_3bcd7bb665d74fcc898be9f401ea2798.pdf?index=true
    • https://9a66ac05-5a89-4b3b-a571-119ee5ad348a.filesusr.com/ugd/a9248e_3c91dec2631b4860886e350add7a52ba.pdf?index=true
    • https://f822fe47-ca54-46b9-bd14-4c21d6e314a7.filesusr.com/ugd/bf0735_6d0bfca0644849bd982c2b54fbc3e78c.pdf?index=true
    • https://478f83f7-4cab-4a99-bced-4a5864a6184c.filesusr.com/ugd/934fc3_fd01acbabf014a72a10fc773d91cba37.pdf?index=true
    • https://ecfc7b3a-ce64-4c68-b688-33f04de8c44b.filesusr.com/ugd/756799_76dfc792ccad457e86089423fd9a5055.pdf?index=true
    • https://f749be74-aef5-4f1f-a083-9771bb43846b.filesusr.com/ugd/0511f5_9504ae56d65a434ab1b9b72d77280496.pdf?index=true
    • https://37374bba-33df-4680-b496-383f7b8307a2.filesusr.com/ugd/a43ec6_e060a43dfee3408a93f926a3a83eb918.pdf?index=true
    • https://a67b6d03-063b-4f9e-8250-df9766252e23.filesusr.com/ugd/b27199_3344bec33d764d318a9b84ce2a90c4bf.pdf?index=true
    • https://9cbbcdce-a040-43b2-a2e4-19ee143932c4.filesusr.com/ugd/590778_94b87059c9764ff8af173f26cb742c00.pdf?index=true
    • https://a2d0f9b9-491c-423a-a3cf-99b336cd2bc2.filesusr.com/ugd/3f8d85_ce8cac53c087441b8b258d4640fa3ab7.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0002213e.bin
df77d0e5d357ea850f42f7feba6013c6ea496744c81e1e97846433a8220f7291		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2213E 5428 bytes
font_01_sfnt_off000233c3.bin
9250d32550c10b2b7cac01f0094130fd5e9275f0b392c416268241cda299cb20		 pdf-font-stream PDF embedded font (sfnt) at offset 0x233C3 15300 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.