Malicious PDF — malware analysis report

Static analysis result for SHA-256 800a759e099f1ea8…

MALICIOUS

PDF

39.6 KB Created: 2020-09-04 13:42:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1df53bfb27d1d886e017f441734f3312 SHA-1: 52f1bb74f2cc0a233045d8e55449801ae0b0bde1 SHA-256: 800a759e099f1ea813b67ce182aed01a1a851cc06f10e1f1b0ca10858f896fd4
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged as malicious due to a critical heuristic indicating it links to known malicious redirector infrastructure. It also contains a large number of external PDF links, many pointing to a domain associated with SEO link farms. The primary malicious URL identified is https://ttraff.club/wix?keyword=free++autoloader+bb+passport, which is likely used to funnel users to further malicious content. No scripts were extracted, and the document body was heavily obfuscated.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/wix?keyword=free++autoloader+bb+passport
    • https://static.usrfiles.com/ugd/b8c837_6d73cf8433204135b91e152131b56768.pdf
    • https://static.usrfiles.com/ugd/3e5d97_aba84cbf7bfa48bba3f55013f121d0a5.pdf
    • https://static.usrfiles.com/ugd/b8c837_0bcdf6cb6138444387f37b9c07b1e985.pdf
    • https://static.usrfiles.com/ugd/ab0441_54231135f61a490e93c776aa60b14e0d.pdf
    • https://cdn.shopify.com/s/files/1/0427/9438/5575/files/95830981327.pdf
    • https://cdn.shopify.com/s/files/1/0430/6819/4978/files/gavudekabotor.pdf
    • https://cdn.shopify.com/s/files/1/0432/6539/2804/files/subordinating_conjunctions_worksheets_for_high_school.pdf
    • https://cdn.shopify.com/s/files/1/0438/0521/2832/files/cara_menggunakan_breast_pump_manual_pureen.pdf
    • https://cdn.shopify.com/s/files/1/0435/7714/7547/files/bikalufigepakisab.pdf
    • https://cdn.shopify.com/s/files/1/0434/8700/2790/files/86919286162.pdf
    • https://cdn.shopify.com/s/files/1/0432/2413/7890/files/18600205659.pdf
    • https://static.usrfiles.com/ugd/5d2cf3_d20d26fe70a84fc79d9d7e48e6f0d8bb.pdf
    • https://static.usrfiles.com/ugd/4d6844_153a2ed09ecb4fb38ea1430f10ff036c.pdf
    • https://static.usrfiles.com/ugd/733c1f_d634b361d5b74e818ff2f4855c785061.pdf
    • https://static.usrfiles.com/ugd/764aaa_e52fcdaf6b9f4e79b146bb2c94b0bf7c.pdf
    • https://static.usrfiles.com/ugd/234f58_40531ecc802246cf9605e4a3746013c2.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000058ed.bin
71ef37464ed71a8fcabcb0a71e8963ddcef756c4d53fd9c1b9c762b23a454623		 pdf-font-stream PDF embedded font (sfnt) at offset 0x58ED 5048 bytes
font_01_sfnt_off00006a19.bin
efeed01ffb33cbb75566a3b3d7edb9a10c91e349467c6d2fa622e13eb9752693		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6A19 12256 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.