Malicious PDF — malware analysis report

Static analysis result for SHA-256 7b1f368f1088ae1a…

MALICIOUS

PDF

54.8 KB Created: 2020-08-31 03:53:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 257742e9d254ad31d15e372928b68ff3 SHA-1: c71635a54c199bba7ae1c8cbf9c8c17880dfbe28 SHA-256: 7b1f368f1088ae1ae5185c508ceb866461fcf6ba59148cc300958734b43bee6b
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document contains a large number of embedded links, with one specifically pointing to a known malicious redirector. The document's content, though heavily obfuscated, includes the URL 'https://ttraff.com/wix?keyword=xcom+2+encrypted+signal', which is flagged as malicious. The presence of numerous links suggests a link farm or redirection strategy to obscure the final malicious destination.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=xcom+2+encrypted+signal
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://static.usrfiles.com/ugd/913720_2837f3029cdf429aa63cb9637b1fd30d.pdf
    • https://static.usrfiles.com/ugd/b8c837_89c8ccee109b40e9ad89d3b19b6d3d23.pdf
    • https://static.usrfiles.com/ugd/07ef24_135ebb41f9874324b2484d55e2997994.pdf
    • https://static.usrfiles.com/ugd/b8c837_e11e319da3e944ceb21665370faddd39.pdf
    • https://static.usrfiles.com/ugd/03ae60_a86db43b879844aca5cf83106bad414d.pdf
    • https://static.usrfiles.com/ugd/f0f215_c56ba9cd657b444b9c1bf2e423ad6f76.pdf
    • https://static.usrfiles.com/ugd/6908d7_45501c6c3daf4a2c9f116e2fc1a6ae20.pdf
    • https://static.usrfiles.com/ugd/e2c250_a12a9e46ffe94c739ab3f31db7d487c3.pdf
    • https://static.usrfiles.com/ugd/f4de5e_ddcd9b8014814dc9872890a8f12667a5.pdf
    • https://static.usrfiles.com/ugd/353d00_b500944893a540fa9ea7a56b88a2d554.pdf
    • https://static.usrfiles.com/ugd/b8c837_579beab33da3427085d8e875e287e70e.pdf
    • https://static.usrfiles.com/ugd/60933b_953cd91e9acc46ee9ec492c83ce79f1d.pdf
    • https://static.usrfiles.com/ugd/48d9a1_b8bbc683a8c64c14aa49ee07bf1d6d0b.pdf
    • https://static.usrfiles.com/ugd/c63dba_c09dcd5c38634f51a2205aae5cf2030b.pdf
    • https://static.usrfiles.com/ugd/b8c837_e0ec9d01b5224ac2b0db595c21313d7c.pdf
    • https://static.usrfiles.com/ugd/0779a3_737ddaba181a44a285ecce3bc2fa96b3.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00009866.bin
86bd2439d5960b64f31505a4792034c3917c21e2f63f1f52a3e0732db584afab		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9866 5604 bytes
font_01_sfnt_off0000ab64.bin
98578b07b256ff38e01b2d2926ddcc0b25cc5e73822c167ebc0acce7785c9df9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAB64 10356 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.