Malicious PDF — malware analysis report

Static analysis result for SHA-256 6ea27aee6545da81…

MALICIOUS

PDF

49.1 KB Created: 2020-09-05 08:06:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1adcce808d4aa128b4f5c8bcc2e50a30 SHA-1: 9e14eccc584887fff8acbd7489a85a4557d4813a SHA-256: 6ea27aee6545da81fd762b73c90f8e54d7be182e74d5c92ea3e3f02ced0d2470
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded links, many pointing to a link farm infrastructure designed to manipulate search engine results or redirect users. One prominent URL, 'https://ttraff.me/wix?keyword=bengal+tiger+songs+ing+coming', is flagged as a malicious redirector. The presence of a large number of external PDF links suggests an attempt to distribute or obscure malicious content, likely as part of a phishing or SEO poisoning campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=bengal+tiger+songs+ing+coming
    • http:///\/telugu.surli.in\/choopulatho-deepala-song-lyrics-bengal-tiger\/,video_url:,zoomit:0,premium_content:0,rest_lev:0,rest_msg_free:null,rest_msg_paid:null,_e:0,aes_enabled:1,aet:1,release_date:Oct
    • http:///\/telugu.surli.in\/asia-khandam-song-lyrics-bengal-tiger-raviteja\/,video_url:,zoomit:0,premium_content:0,rest_lev:0,rest_msg_free:null,rest_msg_paid:null,_e:0,aes_enabled:1,aet:1,release_date:Oct
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://static.usrfiles.com/ugd/bcd086_4d4f87c0f976442199cb8f7961b2414f.pdf
    • https://static.usrfiles.com/ugd/6f53d7_5f0b39dbe7c8439183c8bfb607a6ee02.pdf
    • https://static.usrfiles.com/ugd/e5412a_226cbf9d1b914065a6549632f51316c2.pdf
    • https://static.usrfiles.com/ugd/278743_8985157fa5f54e8a9de2c1ab23a6ac89.pdf
    • https://static.usrfiles.com/ugd/ea9bdf_93e16151da2847bbb2ca1fffacf7b93b.pdf
    • https://static.usrfiles.com/ugd/b8c837_1203834decad448b98ae5f210da8ec49.pdf
    • https://static.usrfiles.com/ugd/8716ab_d46eb16118744d3e89fa47887ff13b22.pdf
    • https://static.usrfiles.com/ugd/b8c837_9917e18e7d0143e69e14cd82f8205fd7.pdf
    • https://static.usrfiles.com/ugd/911c12_381b2464e86b4647b35005f5c0271d23.pdf
    • https://static.usrfiles.com/ugd/b52961_5066bec6695b4e2db933d2cf1863d276.pdf
    • https://static.usrfiles.com/ugd/2f7815_406f1ca519144686952e6cd057358f13.pdf
    • https://static.usrfiles.com/ugd/6a4619_49f037e49a004a3eb4b1377ef6b29b13.pdf
    • https://static.usrfiles.com/ugd/6908d7_476e168690f3489887b217e5a9759e65.pdf
    • https://static.usrfiles.com/ugd/49be48_b97ec004eb54408688e6f67d13cd467a.pdf
    • https://static.usrfiles.com/ugd/d63aaf_b9aec76a3e5b4cf0864d8b9fa3b9d30e.pdf
    • https://static.usrfiles.com/ugd/89064d_f503c7ade78c4596956a2cd750bd0199.pdf
    • https://static.usrfiles.com/ugd/b8c837_c45b466862d24e3e9a3067ae7ffe2457.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000079b6.bin
9e73656bc5b4a188bbd7b4566c25cd95e3ca13bf805c8bb2fed48548d964788e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x79B6 5168 bytes
font_01_sfnt_off00008b3a.bin
e08bc6eb90087a0dc51c78875cf74d1fb129850142402c4673fd5ea5830da460		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8B3A 14156 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.