Malicious PDF — malware analysis report

Static analysis result for SHA-256 6f7872629f1b0638…

MALICIOUS

PDF

40.8 KB Created: 2020-09-02 12:29:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f353421a38e8916b6aa678c67db1b3ac SHA-1: 7470ac265a52c7dc2399cc23fca17a1b2c6806d1 SHA-256: 6f7872629f1b063836f4c9e9721bead0538e9feca76dde5666d8f66587cc0bf2
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains embedded links, one of which, 'https://ttraff.ru/wix?keyword=value+added+non+value+added+template', is identified as a malicious redirector. The document also features a large number of external PDF links, suggesting a link farm or SEO manipulation tactic. The ML classifier strongly flagged this PDF as malicious, indicating a high likelihood of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=value+added+non+value+added+template
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0433/7329/7814/files/kativawagab.pdf
    • https://cdn.shopify.com/s/files/1/0464/7308/5078/files/4885311546.pdf
    • https://cdn.shopify.com/s/files/1/0434/2281/0263/files/34921801450.pdf
    • https://cdn.shopify.com/s/files/1/0432/2305/6545/files/28037520408.pdf
    • https://cdn.shopify.com/s/files/1/0427/6623/7852/files/36445094170.pdf
    • https://cdn.shopify.com/s/files/1/0430/9201/7305/files/bluetooth_headset_huawei_manual.pdf
    • https://cdn.shopify.com/s/files/1/0428/2925/0719/files/lasax.pdf
    • https://cdn.shopify.com/s/files/1/0432/0916/2907/files/sesujuxuripadidovur.pdf
    • https://cdn.shopify.com/s/files/1/0456/8734/1215/files/gagut.pdf
    • https://static.usrfiles.com/ugd/2274a7_a106abcad55542ce927487ba7a935f5d.pdf
    • https://static.usrfiles.com/ugd/8ab72e_8858a3e5145d442d8cfa2e00b893992e.pdf
    • https://static.usrfiles.com/ugd/b916f4_2f914fa307014f5e9cb617f9e3a9ae7f.pdf
    • https://static.usrfiles.com/ugd/b8c837_2a22d6aad4df455fa07ee6a571e12eb8.pdf
    • https://static.usrfiles.com/ugd/269bb8_4c70a3bb5efd425589a0abea782d9b95.pdf
    • https://static.usrfiles.com/ugd/b8c837_632e2fc9bd0c4c289cf19488c141f50f.pdf
    • https://static.usrfiles.com/ugd/e2c250_630cc823fd774384a31ffb1bbf4919e1.pdf
    • https://static.usrfiles.com/ugd/b8c837_0914cf91d1d74eb097ffca1d1712fcdc.pdf
    • https://static.usrfiles.com/ugd/cd79e3_639ebdc677444533a6d01c8e39095ca3.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000061b9.bin
8f59ccfdb0f0fa9c890f5eb6349dae985bdccdd13502765a910fa58538388287		 pdf-font-stream PDF embedded font (sfnt) at offset 0x61B9 4856 bytes
font_01_sfnt_off00007239.bin
095299fcc5a8aa4577434feae7e671c9add7a3700e076522807a879d66badf1b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7239 10668 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.