Malicious PDF — malware analysis report

Static analysis result for SHA-256 9d7d551a65b50168…

MALICIOUS

PDF

33.6 KB Created: 2020-09-18 16:12:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c156bfc41f861304f0b0580975a6ef00 SHA-1: f4be739a8be0da11398f65b5e09cd19820d4f34f SHA-256: 9d7d551a65b50168a618d586ddc0b0a83ea506e18fcef0659fcdf7cc9e8435a8
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains numerous embedded links, with a critical heuristic firing for a malicious redirector. The primary malicious URL identified is https://ttraff.club/wix?keyword=mapleroyals+night+lord+hp+wash+guide. The document body, though heavily obfuscated, contains references to this URL and other PDF links, suggesting a link farm or redirection scheme designed to lead users to malicious content. The presence of multiple PDF links and a malicious redirector indicates a probable attempt to distribute malware or phish for credentials.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/wix?keyword=mapleroyals+night+lord+hp+wash+guide
    • http://xusiwenul.lockmangenetics.com/uploads/1/3/1/4/131407921/muboxog_vopan.pdf
    • http://mogow.angelaadockter.com/uploads/1/3/2/6/132680835/844e34d74cb.pdf
    • http://files.ambleon.net/uploads/1/3/1/0/131070125/zulalusimutolosu.pdf
    • http://pogifuzid.nakedtrackdays.net/uploads/1/3/0/7/130775403/divusufopan.pdf
    • https://f9fe4c64-c7f3-4371-b764-56b848428cbe.filesusr.com/ugd/3e87bf_743c36e6f7204304bde929c1a0221e52.pdf?index=true
    • https://e50942aa-bf08-4c9c-b133-60b7a0449e67.filesusr.com/ugd/bb3bf9_aa812fcdb7ae45fa9dab261dd007a9d3.pdf?index=true
    • https://f95ad532-c562-461f-b126-81962e2358e8.filesusr.com/ugd/e2c250_250864e7d89b491c84c4cf092826387c.pdf?index=true
    • https://24c09e42-13eb-432f-934c-0d609ba89d8f.filesusr.com/ugd/48f461_7b633f29fcfe4ff2b9ba98bbf220e030.pdf?index=true
    • https://2a43cf41-63c6-4a3a-b0fe-04e3680482e1.filesusr.com/ugd/0aab01_bf696313eb7645ccba4a722028fa6408.pdf?index=true
    • https://d7b9ee67-6482-42ea-8eb3-0f219069e1fc.filesusr.com/ugd/d38238_68270b8e459646bdbdfa141b8d022f13.pdf?index=true
    • https://9b2189bb-1969-4ff9-a4b4-9b0c6ecb4fa4.filesusr.com/ugd/a13bc2_4d57deed9bfe450f93b9103b51936abb.pdf?index=true
    • https://d80bd232-e501-45ae-873a-bcc68294a790.filesusr.com/ugd/ce14f3_027fae721d604294b94db5b1b7e8f84d.pdf?index=true
    • https://38cb5e0f-5f8b-4849-93cd-9afcc30ebf39.filesusr.com/ugd/cacfd7_4699d22c9b2849b5a54439d4bcab9699.pdf?index=true
    • https://bdaafc6a-6ac4-4d2d-a370-bd6dab2bdbd4.filesusr.com/ugd/cc15ef_5ed9f25ba89c47caae619d85c66a047a.pdf?index=true
    • https://9e84c353-c2c7-4147-b5b9-655a8ae09d08.filesusr.com/ugd/5c9621_4f2fbe9f54254baf93c5abb9ddc6e7c5.pdf?index=true
    • https://f232aacb-9c6d-4014-b434-895eb49d6678.filesusr.com/ugd/7be1cd_382f7083d1eb4d83992ecac7f4911b83.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000046e6.bin
cceb2df674321fb5f20a0f6e0b4ed8671d996ad24e6770fb9acf235a18847f49		 pdf-font-stream PDF embedded font (sfnt) at offset 0x46E6 5420 bytes
font_01_sfnt_off0000596a.bin
b66b1d71ef23a370fa2aafe5c5a792773a4d0f688d68b68d0ad82f342851f7fc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x596A 9372 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.