Malicious PDF — malware analysis report

Static analysis result for SHA-256 77cb6e6611e0c4b6…

MALICIOUS

PDF

57.8 KB Created: 2020-09-01 01:16:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: cd94ca9e19e4f463e68093849b17dd0d SHA-1: 86e72629a52bb0cbfc6d8bb5c3c7a60c6ae7427f SHA-256: 77cb6e6611e0c4b6f49a1f28cb6f9cebcc47cfd8ac1a71136c563e290e46aa2c
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links, many of which point to external PDF files, suggesting a link farm or SEO poisoning attempt. One critical heuristic identified a link to a known malicious redirector infrastructure at 'https://ttraff.ru/wix?keyword=la+cicala+e+la+formica+rodari+testo'. The ML classifier also strongly indicated maliciousness. The document body, though heavily obfuscated, contains references to the redirector URL and other PDF links.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=la+cicala+e+la+formica+rodari+testo
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0437/2103/1832/files/oathbound_paladin_build.pdf
    • https://cdn.shopify.com/s/files/1/0430/4361/8965/files/zudoxibiwowifedasumixi.pdf
    • https://cdn.shopify.com/s/files/1/0434/9237/6741/files/bert_bidirectional_encoder_representations_from_transformers.pdf
    • https://cdn.shopify.com/s/files/1/0434/0976/8600/files/renitejovafuruf.pdf
    • https://cdn.shopify.com/s/files/1/0436/8033/3989/files/46006977328.pdf
    • https://static.usrfiles.com/ugd/99965f_0e615ea87ab84785a7d0ce05bac30025.pdf
    • https://static.usrfiles.com/ugd/77d535_030e12cc6d114882b96be245fff9b927.pdf
    • https://static.usrfiles.com/ugd/e5a943_9fe3c6c3bb5e46768bae3c165615f350.pdf
    • https://cdn.shopify.com/s/files/1/0433/8896/0933/files/43057626656.pdf
    • https://cdn.shopify.com/s/files/1/0448/2121/7442/files/corong_pemisah.pdf
    • https://static.usrfiles.com/ugd/b88e3d_7fbde2d24e0e4f70a67ed09bd53a6217.pdf
    • https://static.usrfiles.com/ugd/b8c837_12e2901ca1c145948045ab55253cd9b9.pdf
    • https://static.usrfiles.com/ugd/b8c837_8bcff15cfa1c4370b1d950ab64693aab.pdf
    • https://static.usrfiles.com/ugd/b8c837_29e7b3aade4a4eb8bb125d60c744419c.pdf
    • https://static.usrfiles.com/ugd/cd79e3_e630c4a9b23644f083821e0ba85e9b9a.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000721a.bin
8c18e5160d1c7cd3a8bca2804c1dd3581b8b419080f1230a97fd6d3f3d4eab2a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x721A 5108 bytes
font_01_sfnt_off0000835f.bin
929e673af8c8ddd4f3bf3e21e4dad78770b57e7a2d890469958a20d5f072c59a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x835F 5432 bytes
font_02_sfnt_off00009788.bin
b6feaf65acd2d6fa9083f9a0d2afa3b8f4fbfee6eec28655c78308bd433c1da4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9788 12100 bytes
font_03_sfnt_off0000be56.bin
ec996bafd85507689dcf78184cdb4c4e64cd0c929546b6501ea6db4d9a2c1305		 pdf-font-stream PDF embedded font (sfnt) at offset 0xBE56 17916 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.