Malicious PDF — malware analysis report

Static analysis result for SHA-256 72e2bee059ac5268…

MALICIOUS

PDF

42.0 KB Created: 2020-08-04 09:30:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5da69356fc29f993febca52b3a9d5039 SHA-1: 8f5fb47b77702666c4bed346865c9867148cf18b SHA-256: 72e2bee059ac526814060c5e77c74b402337416ef92ad29710141d256c8ce57d
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous links, including one pointing to a known malicious redirector, ttraff.com. The document body, though partially obfuscated, contains text related to a 'Calendrier belge 2020 pdf' and includes the malicious URL, suggesting a lure to redirect users to potentially harmful content. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=calendrier+belge+2020+pdf
    • http://files.teamveventing.com/uploads/1/3/0/7/130739928/4658341.pdf
    • http://files.mountainblueharmony.com/uploads/1/3/0/9/130969628/ladokaparobuwem.pdf
    • http://files.thsprojectlead.com/uploads/1/3/1/3/131383747/pezawafojo_tidopokiduniti_nubawata_kaxulukibefeje.pdf
    • http://files.prometheanrebellion.com/uploads/1/3/0/8/130814353/sizurubopi_vexupoxofapu.pdf
    • http://files.padrepiogroup.org/uploads/1/3/2/6/132680905/1590527.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/76102764406.pdf
    • https://cdn.shopify.com/s/files/1/0427/5752/1574/files/jupebewonutuwo.pdf
    • https://cdn.shopify.com/s/files/1/0435/3484/4059/files/77295996513.pdf
    • https://cdn.shopify.com/s/files/1/0437/9371/1261/files/creative_design_process.pdf
    • https://cdn.shopify.com/s/files/1/0437/0422/1849/files/icy_tower_download.pdf
    • https://cdn.shopify.com/s/files/1/0435/2563/6248/files/47701313307.pdf
    • https://cdn.shopify.com/s/files/1/0432/7027/5237/files/32768081902.pdf
    • https://cdn.shopify.com/s/files/1/0429/9243/5359/files/93173007515.pdf
    • https://cdn.shopify.com/s/files/1/0429/6055/2085/files/26948897077.pdf
    • https://cdn.shopify.com/s/files/1/0430/3477/1610/files/bewurij.pdf
    • https://cdn.shopify.com/s/files/1/0434/8595/4198/files/kamilir.pdf
    • https://cdn.shopify.com/s/files/1/0432/8561/0654/files/dinodozu.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/berujixawajibexuxutuzogar.pdf
    • https://cdn.shopify.com/s/files/1/0429/5213/0716/files/28573375167.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000559d.bin
54138b1b89d666637bc0acf7a23d4018430bb52755ac477e0eba93ce77172b31		 pdf-font-stream PDF embedded font (sfnt) at offset 0x559D 5068 bytes
font_01_sfnt_off000066de.bin
6ea24678c3ed06081c97bde9937a2db08ae36f956c270e282ab4734f384106c6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x66DE 11908 bytes
font_02_sfnt_off00008b90.bin
7f6049e5011acf0e8581793f2bc2bb947aac2929fdb77abc318b2a6155c1ef71		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8B90 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.