Malicious PDF — malware analysis report

Static analysis result for SHA-256 754a8a9ca96f4327…

MALICIOUS

PDF

41.8 KB Created: 2020-08-31 18:22:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7df0f64f92db027adf1cad02600463d3 SHA-1: 660d76d350a87ce00fcae403ed28c129b8c571d5 SHA-256: 754a8a9ca96f43279806862d9cec227447932aafd34b0b9734ab89716150ca9a
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file contains numerous links, a significant portion of which point to a link farm designed to distribute malicious content. One prominent URL, 'https://ttraff.club/wix?keyword=rainbow+table+attack++free', is identified as a malicious redirector. The document's content and structure suggest an attempt to deceive users into clicking these links, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/wix?keyword=rainbow+table+attack++free
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://static.usrfiles.com/ugd/b91566_15c97575d9f84688b799cbff1a1e635b.pdf
    • https://static.usrfiles.com/ugd/a4d998_c3ed639115d943dea7350dedac3362c2.pdf
    • https://static.usrfiles.com/ugd/0f5b72_e17cc70e5d264bcd8b3fa0e2b82bad9b.pdf
    • https://static.usrfiles.com/ugd/dc98cc_1090ce0b7ac24a07849d4127f90ff1eb.pdf
    • https://static.usrfiles.com/ugd/bf07b1_6efa98092c324ca395f14a7b70e7b4f2.pdf
    • https://cdn.shopify.com/s/files/1/0430/9791/5545/files/70718744348.pdf
    • https://cdn.shopify.com/s/files/1/0438/5597/0454/files/full_form_of_virus_in_computer_science.pdf
    • https://cdn.shopify.com/s/files/1/0433/7372/3800/files/88250404438.pdf
    • https://cdn.shopify.com/s/files/1/0436/7787/6377/files/46846855870.pdf
    • https://cdn.shopify.com/s/files/1/0433/3728/5797/files/79388871695.pdf
    • https://cdn.shopify.com/s/files/1/0434/7189/6736/files/objective_advanced_vocabulary_list.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/lufixupiz.pdf
    • https://static.usrfiles.com/ugd/b8c837_9d879c01657647f4bca53c28aa17a044.pdf
    • https://static.usrfiles.com/ugd/0a593f_63df55c90cf7406ea24fea147dd0e72b.pdf
    • https://static.usrfiles.com/ugd/de65f7_03817a6d8701422889a2d118eadd5841.pdf
    • https://static.usrfiles.com/ugd/a107db_bb7f8bdab0f74a94a5a143e92e369b1f.pdf
    • https://static.usrfiles.com/ugd/4dd980_33733ae418cf44969cdfa0b71e3c6da9.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000650a.bin
c57590dcde521dbcd314bd847752c5ab5b94c63dc5e996aba1ece6837fe7e003		 pdf-font-stream PDF embedded font (sfnt) at offset 0x650A 5000 bytes
font_01_sfnt_off0000763b.bin
5c215df1f6b6307e8c785afe4b02b9a158289b25d94b8dd6e4ce23ddda17e9e3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x763B 10616 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.