Malicious PDF — malware analysis report

Static analysis result for SHA-256 85904db53c9b7dd8…

MALICIOUS

PDF

43.5 KB Created: 2020-08-23 00:40:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b7cac15c88190b8f5be44883c1231ff8 SHA-1: 1a460a8aaef655662ff6a13dc68970bdbfc47745 SHA-256: 85904db53c9b7dd88ad34acc95fc41109f8f1967a06148f8cfafec777ff8906a
194 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains heuristics indicating it is a malicious redirector and an advance-fee scam lure, presenting itself as an insurance claims guide. It embeds numerous links, with the primary redirector pointing to 'ttraff.com'. The document body, though partially corrupted, contains text related to 'Sunsuper for life insurance claims guide' and the malicious URL, reinforcing the phishing and redirection intent. No scripts were extracted, but the embedded links are the primary indicators of malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=sunsuper+for+life+insurance+claims+guide
    • http://fumosek.smileysjoy.com/uploads/1/3/1/8/131857631/8bcd336863.pdf
    • http://wufukekez.taylorcraigsutton.com/uploads/1/3/1/0/131070374/118656.pdf
    • http://files.arthurmorgan.co.uk/uploads/1/3/2/6/132695543/folobo.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://cdn.shopify.com/s/files/1/0437/1133/2503/files/pasar_de_cade_simu_a.pdf
    • https://cdn.shopify.com/s/files/1/0435/8812/4830/files/the_wolf_of_wall_street.pdf
    • https://cdn.shopify.com/s/files/1/0431/7652/5984/files/lifegozawobixakix.pdf
    • https://cdn.shopify.com/s/files/1/0433/8915/7532/files/31613935990.pdf
    • https://cdn.shopify.com/s/files/1/0435/2730/7423/files/diopter_chart_for_reading_glasses.pdf
    • https://cdn.shopify.com/s/files/1/0428/4694/5436/files/mimorefivugizituxok.pdf
    • https://cdn.shopify.com/s/files/1/0435/3658/0759/files/48500573866.pdf
    • https://cdn.shopify.com/s/files/1/0431/3464/8482/files/65898516010.pdf
    • https://cdn.shopify.com/s/files/1/0431/7030/0065/files/alien_vs_predator_arcade_game_pc.pdf
    • https://cdn.shopify.com/s/files/1/0438/0819/4722/files/analytical_iq_questions_with_answers.pdf
    • https://cdn.shopify.com/s/files/1/0436/0133/0340/files/sajawozowagudawaxajafuf.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005e97.bin
224b7ecc51f7c7052e5d232dee6db16ba28d9b0a59b6362d40a12abaed4596e7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5E97 5380 bytes
font_01_sfnt_off000070b0.bin
69d54390452d3e947ad26cd38e7e7acda9d7a73cb2e68717b3ece86910052501		 pdf-font-stream PDF embedded font (sfnt) at offset 0x70B0 10012 bytes
font_02_sfnt_off000092f3.bin
d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378		 pdf-font-stream PDF embedded font (sfnt) at offset 0x92F3 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.