Malicious PDF — malware analysis report

Static analysis result for SHA-256 849e3383f20683d6…

MALICIOUS

PDF

53.5 KB Created: 2020-08-11 12:00:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e37df0ca77d5a923a9572ed901f73b7c SHA-1: 7ebf0e72e70209cfdeaafe0e83fb9a6940f17cad SHA-256: 849e3383f20683d6685f5b47a73eca6da7a33548c0cf0fb6a9b7e0641472e435
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links, many of which point to a link farm designed to redirect users to malicious infrastructure. The primary malicious URL identified is ttraff.ru, which is flagged as a known malicious redirector. The document body, though partially obfuscated, contains text related to 'ge atualidades 2020 2 semestre pdf' and the malicious URL, suggesting a lure to trick users into clicking on the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=ge+atualidades+2020+2+semestre+pdf
    • http://files.asthecrowfliesandco.com/uploads/1/3/2/7/132740285/ab819754e64.pdf
    • http://files.personalspaceproject.com/uploads/1/3/2/7/132740343/piwepapefa-kavijabojexopi-fuwuwumewa.pdf
    • http://zerupiw.ambiancegardendesign.com/uploads/1/3/1/3/131380729/kazopuje.pdf
    • http://files.scholasticlead.com/uploads/1/3/1/4/131409761/sepuzevenine.pdf
    • http://files.serenaashley.com/uploads/1/3/2/7/132712222/3070330.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0440/1990/8758/files/periodic_table_trends_worksheet_answers.pdf
    • https://cdn.shopify.com/s/files/1/0430/8641/3985/files/calculus_early_transcendentals_3rd_edition_briggs.pdf
    • https://cdn.shopify.com/s/files/1/0436/7931/8166/files/teaching_grammar_approaches_and_methods.pdf
    • https://cdn.shopify.com/s/files/1/0429/7303/6697/files/sedubuvaseleki.pdf
    • https://cdn.shopify.com/s/files/1/0430/9798/1089/files/72034573673.pdf
    • https://cdn.shopify.com/s/files/1/0437/3993/8970/files/vcftools_manual.pdf
    • https://cdn.shopify.com/s/files/1/0435/7675/4344/files/72385627085.pdf
    • https://cdn.shopify.com/s/files/1/0431/6489/3345/files/nakinovib.pdf
    • https://cdn.shopify.com/s/files/1/0431/3343/6055/files/gojewaxoxovaxaxafanalak.pdf
    • https://cdn.shopify.com/s/files/1/0432/7846/7222/files/tuzidarepukituwif.pdf
    • https://cdn.shopify.com/s/files/1/0436/3524/5216/files/numeros_romanos_1_al_10000.pdf
    • https://cdn.shopify.com/s/files/1/0436/9409/6539/files/mutari.pdf
    • https://cdn.shopify.com/s/files/1/0449/3908/3944/files/power_electronics_mcqs_with_answers.pdf
    • https://cdn.shopify.com/s/files/1/0432/5317/0334/files/93197304168.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007a86.bin
b2b3916534c201cc1722fc0f631f6ed71f75f772fd8333d8b8a755ff81fa6395		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7A86 5492 bytes
font_01_sfnt_off00008d1f.bin
c13389051621bc0e3029cec1e5d56c1086218f1c83995184e28e0dc53c5b8151		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8D1F 11592 bytes
font_02_sfnt_off0000b2ea.bin
532315dfdc59b350d447ad91845dd8cc72a836e684f536ab9a4305dc5b53fb8e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB2EA 16204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.