Malicious PDF — malware analysis report

Static analysis result for SHA-256 7a4b264ccb2a5db2…

MALICIOUS

PDF

39.6 KB Created: 2020-08-30 20:50:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e98c6401313dad4e92244b8413df0c8e SHA-1: b77e0bc16f272aba8c15d498e3c36e37bfcb2302 SHA-256: 7a4b264ccb2a5db2b25302adad5117e2119a1c41709c5819e4b1949b9d97dcc4
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a large number of embedded links, many of which point to a redirector infrastructure. The primary URL identified, 'https://ttraff.ru/wix?keyword=mass+of+copper+in+kg', is flagged as malicious. This suggests an attempt to direct users to harmful content, likely as part of a phishing or malware distribution scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=mass+of+copper+in+kg
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://static.usrfiles.com/ugd/10b11f_3d2eb817faca4e2aa6419859d58f7d95.pdf
    • https://static.usrfiles.com/ugd/0cd019_38bc850dfe6a43bbb8de87b9ad27b716.pdf
    • https://static.usrfiles.com/ugd/b8c837_2fed23da47a243e8a8a57909dc5aaee9.pdf
    • https://static.usrfiles.com/ugd/f4de5e_0876e23fe892479c8f38ab35db340f23.pdf
    • https://static.usrfiles.com/ugd/79e0dc_7f5a5b9e430044bb80f2fff4e21369a4.pdf
    • https://static.usrfiles.com/ugd/9757e7_2bd7231662eb4694b43e7741fbc0abb9.pdf
    • https://static.usrfiles.com/ugd/b8c837_759fa00d1b73406ab04d855dd876ea7d.pdf
    • https://static.usrfiles.com/ugd/accd1f_3a46132c74154d0ea1cd6b3835b27f2e.pdf
    • https://static.usrfiles.com/ugd/225520_e0fe7cb3dbe548e3a10e443ebf0a24a0.pdf
    • https://static.usrfiles.com/ugd/b8c837_f3f4a0e144e5436d86d7252bc50e2254.pdf
    • https://static.usrfiles.com/ugd/10e3af_7d2d21898afb4215b423b56efcf5d336.pdf
    • https://static.usrfiles.com/ugd/b8c837_f1537bbddb36496ba8d58b19bf8e11e4.pdf
    • https://static.usrfiles.com/ugd/d775a9_686cc54717d74b62bc6f82cdb5f2a876.pdf
    • https://static.usrfiles.com/ugd/086daf_3ebcba5c69bc45fa8ff909fa94e73170.pdf
    • https://static.usrfiles.com/ugd/b8c837_895bc1339dad4deebd748217b346c316.pdf
    • https://static.usrfiles.com/ugd/b8c837_591654e411f94a9eab90d94087a75b17.pdf
    • https://static.usrfiles.com/ugd/87b9a8_6c157e9d95d441169716f273b9ce4b35.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000502e.bin
7a295b4ce962c8901a22145b0c0e9977db4be7c095784c9dbeb0d3e57e3ffc71		 pdf-font-stream PDF embedded font (sfnt) at offset 0x502E 4928 bytes
font_01_sfnt_off000060fc.bin
a635c1ce111407a1be1ab4b50cde1eecfbd4b6b9ed9db2b1b6f484f449b2043c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x60FC 10292 bytes
font_02_sfnt_off00008378.bin
4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8378 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.