Malicious PDF — malware analysis report

Static analysis result for SHA-256 8ed785bf8a34b702…

MALICIOUS

PDF

51.5 KB Created: 2020-10-23 06:34:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e291c8ca1375d81ce656512c0c61199c SHA-1: 752c1542f07369f6647c4ef06b0e89c7e89f8378 SHA-256: 8ed785bf8a34b702956a50ba8d6f3f585fd386c21ab77b7496a608836b3a6366
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded links, including a redirector URL and a link farm pointing to other PDFs. The primary URL, https://ttraff.me/123?keyword=live+net+tv+4.7+mod+apk+download, suggests a lure for downloading software. The ML classifier strongly flagged this PDF as malicious, and the presence of a link farm indicates a coordinated effort to distribute content, likely malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/123?keyword=live+net+tv+4.7+mod+apk+download
    • https://xukaxikerebata.weebly.com/uploads/1/3/4/0/134042698/163ad7a4c8.pdf
    • https://riragojefo.weebly.com/uploads/1/3/1/8/131857115/7dfb12dde.pdf
    • https://vaxedokumam.weebly.com/uploads/1/3/4/2/134266394/xixukepazere.pdf
    • https://sopopubepomexak.weebly.com/uploads/1/3/4/2/134265445/552cb7.pdf
    • https://rabexowubomisuw.weebly.com/uploads/1/3/1/4/131407155/teduzaxovez-wemojakemoma.pdf
    • https://cdn-cms.f-static.net/uploads/4368748/normal_5f8951444a7e1.pdf
    • https://cdn-cms.f-static.net/uploads/4390642/normal_5f911cd287be3.pdf
    • https://cdn-cms.f-static.net/uploads/4383688/normal_5f8cecb3a8d5a.pdf
    • https://cdn-cms.f-static.net/uploads/4377102/normal_5f8a5f55b0920.pdf
    • https://siregudak.weebly.com/uploads/1/3/0/7/130738759/8459096.pdf
    • https://zusaneji.weebly.com/uploads/1/3/0/8/130813769/44fface.pdf
    • https://mabanopovofed.weebly.com/uploads/1/3/1/4/131453130/a3202e3bb0eb.pdf
    • https://bilewazivabo.weebly.com/uploads/1/3/2/8/132816117/0fd84481.pdf
    • https://kuwofepex.weebly.com/uploads/1/3/2/7/132740654/lerifipadoxaxorubo.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0486/4324/4200/files/tabla_de_integrales_definidas.pdf
    • https://cdn.shopify.com/s/files/1/0484/9313/3986/files/kids_sewing_machine_projects.pdf
    • https://cdn.shopify.com/s/files/1/0440/2295/6197/files/89524958330.pdf
    • https://cdn.shopify.com/s/files/1/0495/7208/5926/files/bipatexitu.pdf
    • https://cdn.shopify.com/s/files/1/0495/8365/3016/files/project_portfolio_manager_job_description.pdf
    • https://cdn.shopify.com/s/files/1/0497/5008/1690/files/assessment_center_test.pdf
    • https://cdn.shopify.com/s/files/1/0266/8779/9492/files/dusotozebirixekubot.pdf
    • https://cdn.shopify.com/s/files/1/0476/7481/8726/files/spotify_premium_apk_download_cracked_ios.pdf
    • https://cdn.shopify.com/s/files/1/0485/8763/6896/files/verizon_ellipsis_jetpack_mhs800l_manual.pdf
    • https://cdn.shopify.com/s/files/1/0502/5801/8472/files/bart_millard_net_worth_mercyme.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007129.bin
6ff3852d9067567ebad52c219fc340712d9782b365661ac22df0011b4ed532c6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7129 5188 bytes
font_01_sfnt_off000082f2.bin
77dbcd01d9da85f3b472273a46510484ca60db5bd936cfe316427ba9ec42a55b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x82F2 10924 bytes
font_02_sfnt_off0000a8a1.bin
2732c78df68b4531e26da51a256f0f9ab881cb8a96d1886ade34872d88eeece3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA8A1 16140 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.