Malicious PDF — malware analysis report

Static analysis result for SHA-256 78ad97cdbaeb2108…

MALICIOUS

PDF

51.8 KB Created: 2020-10-27 22:03:33 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 282eb4bd8d8c070450b23ffc85bad5a2 SHA-1: 9509200d22189376b75002abebda86de9339e55b SHA-256: 78ad97cdbaeb2108122fc55b3c8489de84c65c2c664b8e667eb88b5241230077
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded links, including a primary redirector link to 'ttraff.link' and a large number of links to PDF files hosted on weebly.com and other platforms. The document body, though partially corrupted, contains text related to 'jailbreak iphone 8 plus' and the redirector URL, suggesting a lure to trick users into visiting malicious sites. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/123?keyword=how+to+jailbreak+iphone+8+plus
    • https://sixapinipuso.weebly.com/uploads/1/3/1/3/131384402/lifadelalasuga.pdf
    • https://texitanoz.weebly.com/uploads/1/3/0/7/130739996/malada-biniregokase-joredaletefax.pdf
    • https://jiwadurator.weebly.com/uploads/1/3/0/7/130776405/gitiwebopusose.pdf
    • https://jirukikemika.weebly.com/uploads/1/3/4/3/134310088/281a7df2f71626c.pdf
    • https://dubuzosokiboxof.weebly.com/uploads/1/3/1/1/131163723/zafifono.pdf
    • https://cdn-cms.f-static.net/uploads/4369190/normal_5f8a6fdad44c3.pdf
    • https://cdn-cms.f-static.net/uploads/4368246/normal_5f89f3e296f1f.pdf
    • https://cdn-cms.f-static.net/uploads/4367912/normal_5f94fbf4a0114.pdf
    • https://cdn-cms.f-static.net/uploads/4369784/normal_5f88bfe3e0439.pdf
    • https://cdn-cms.f-static.net/uploads/4373987/normal_5f8d373c10b6a.pdf
    • https://cdn-cms.f-static.net/uploads/4393180/normal_5f911d63496ad.pdf
    • https://cdn-cms.f-static.net/uploads/4388289/normal_5f922e3975531.pdf
    • https://cdn-cms.f-static.net/uploads/4366305/normal_5f876ecea7a52.pdf
    • https://cdn-cms.f-static.net/uploads/4368492/normal_5f88d8e6611d6.pdf
    • https://zodovamerevi.weebly.com/uploads/1/3/4/3/134316438/b07387a0.pdf
    • https://sokuvotaboraj.weebly.com/uploads/1/3/0/7/130776263/wukipotopawomon_lifasi_kutapitu_zubade.pdf
    • https://jazexupojofon.weebly.com/uploads/1/3/1/4/131409098/visineneso.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/niporofez/addition_polymerization_mechanism.pdf
    • https://s3.amazonaws.com/kavitokolezub/nvidia_shield_tv_manual.pdf
    • https://s3.amazonaws.com/xapidajovaji/the_bible_timeline_chart.pdf
    • https://s3.amazonaws.com/dudurat/16765182734.pdf
    • https://uploads.strikinglycdn.com/files/1550441c-8bdd-4a6e-9809-e83bceaaf5c4/ziwewiv.pdf
    • https://uploads.strikinglycdn.com/files/d33b62d5-53f0-43a5-a963-0a5aaab5445d/51973701618.pdf
    • https://uploads.strikinglycdn.com/files/8f63293f-5a5f-4aeb-b2ed-5c0d048e0f7f/49485082492.pdf
    • https://uploads.strikinglycdn.com/files/21538679-4140-4324-a33e-51028ebd9144/nanapir.pdf
    • https://uploads.strikinglycdn.com/files/3065a31a-738f-43c4-9d11-bda4443ece55/9152513221.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008943.bin
ccc1ecfe611b8891672f8f9daf7d01221acd7da966d514a6a5ed794d99d27677		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8943 5432 bytes
font_01_sfnt_off00009bbf.bin
8c9fd442a078e279316779673c1871b28e407c123b60857e1a4fba3e2e9514ff		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9BBF 11140 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.