Malicious PDF — malware analysis report

Static analysis result for SHA-256 8297ed90887f22c9…

MALICIOUS

PDF

35.5 KB Created: 2020-09-02 01:24:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 81c6c4c4446c1c17992ea74470911d8e SHA-1: 5671c6c3a15733f78709dbb53006a93aec5bf195 SHA-256: 8297ed90887f22c9b2d4a2a7af56f0509797ac5184222599755c7e880e3ea604
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document contains a large number of embedded links, many of which point to a link farm designed to redirect users to potentially malicious content. The primary redirector URL is https://ttraff.link/wix?keyword=rod+wave+hunger+games+3+zip, which is flagged as malicious. The document's structure and content suggest a phishing or scam attempt leveraging SEO tactics to attract victims.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/wix?keyword=rod+wave+hunger+games+3+zip
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://static.usrfiles.com/ugd/eb4c03_b6b74fa39ce142d09eda96d688d2479c.pdf
    • https://static.usrfiles.com/ugd/b4a829_ad4df208f5eb47a39536aa332e9933c4.pdf
    • https://static.usrfiles.com/ugd/ca300b_b4f9e458b07043d8b34bf965268105d1.pdf
    • https://static.usrfiles.com/ugd/1479de_1c327158396848f5adb3226a6afa685b.pdf
    • https://static.usrfiles.com/ugd/b8c837_5844bef1d722463685ebc3e8c95d2e04.pdf
    • https://static.usrfiles.com/ugd/b8c837_72a77c6f42df4815a362f73cc5c5168a.pdf
    • https://static.usrfiles.com/ugd/3b0c81_9206422e8cc24b48b583f1260ae24657.pdf
    • https://static.usrfiles.com/ugd/fbccce_9624bd7f0132427faf5d25eeba71e986.pdf
    • https://static.usrfiles.com/ugd/d79848_dd4f3a817099486598538432ce71f443.pdf
    • https://static.usrfiles.com/ugd/9ec29b_3c71d72c92b448f38166ad6e5e69487e.pdf
    • https://static.usrfiles.com/ugd/50de67_31dab9118c894b6a80920fba261e6dad.pdf
    • https://static.usrfiles.com/ugd/ef7b09_6f39fca699db45ddbb15939fd2791848.pdf
    • https://static.usrfiles.com/ugd/b11f6d_cac0a71f116740aebed68e2cfdf28b63.pdf
    • https://static.usrfiles.com/ugd/b4609a_8a26da01e714407590a8e1507f262c74.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000498d.bin
6a684ff20462650e80bc95265149f43280775648caf672415fa9b92a0a2650c2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x498D 5716 bytes
font_01_sfnt_off00005d04.bin
8f5486a482109a0685cdbc1a2357ba39906c3c1028b5decfc9577744e5def344		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5D04 10676 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.