Malicious PDF — malware analysis report

Static analysis result for SHA-256 aa54c7a3ea760e59…

MALICIOUS

PDF

55.0 KB Created: 2020-09-12 03:42:19 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0c10ab05916b5c8d93524ee99cce4163 SHA-1: 2b1217e80419af857e6a6a4e0bde823ca7b5d074 SHA-256: aa54c7a3ea760e590f0071881ac26a77abb8cfbb844d3f432a38a3ad21255ec7
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.me/wix?keyword=asphalt+8+game++for+tizen'. The document body also contains this URL and numerous other links to PDF files hosted on various domains, indicative of a link farm. The ML classifier also strongly flagged this PDF as malicious. The primary attack pattern involves luring users to click the malicious link under the guise of a game download.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=asphalt+8+game++for+tizen
    • http://ziletag.taasro.org/uploads/1/3/0/7/130739663/duxurizikalof.pdf
    • http://vesakejev.rahimaferguson.co.uk/uploads/1/3/2/3/132303195/bamod.pdf
    • http://files.mrobinsonmusic.com/uploads/1/3/0/7/130739119/vobog.pdf
    • http://nekago.templemedsga.com/uploads/1/3/0/7/130738615/komotev_savon_wapiwulejigo.pdf
    • https://static.usrfiles.com/ugd/b85eb0_35012398131b4a9684536c2ec1efc77d.pdf
    • https://static.usrfiles.com/ugd/289c5e_6cb9547e1f484135b297041ae210d001.pdf
    • https://cdn.shopify.com/s/files/1/0436/1083/3058/files/33436245801.pdf
    • https://cdn.shopify.com/s/files/1/0435/2029/5064/files/nijegujog.pdf
    • https://cdn.shopify.com/s/files/1/0433/6074/7688/files/spatial_econometrics_book.pdf
    • https://cdn.shopify.com/s/files/1/0435/8271/8115/files/98385212145.pdf
    • https://cdn.shopify.com/s/files/1/0434/6131/2676/files/vibaju.pdf
    • https://cdn.shopify.com/s/files/1/0430/8592/2466/files/wojufodijaxegamoju.pdf
    • https://cdn.shopify.com/s/files/1/0462/9037/0720/files/sujeroputazadorogi.pdf
    • https://cdn.shopify.com/s/files/1/0459/8343/2866/files/transition_words_used_in_argumentative_essays.pdf
    • https://cdn.shopify.com/s/files/1/0437/9174/5175/files/guilty_crown_complete_soundtrack_flac.pdf
    • https://cdn.shopify.com/s/files/1/0429/1212/0998/files/73779760369.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000065fd.bin
5a7f4d5361a92fbe4e18c8d5d77851fb4263786b3aad319501846a06c60a7950		 pdf-font-stream PDF embedded font (sfnt) at offset 0x65FD 7256 bytes
font_01_sfnt_off00007ec1.bin
53ffedbafbc3fd8131da3c80bc6fb0804f9a29c62f00bc4f4b6d02c20009e2e7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7EC1 5548 bytes
font_02_sfnt_off0000917b.bin
439abbd9388855b50c59e84aba5e3701c257d8e0f3c0e0f2cf17d0b378f82dd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x917B 10368 bytes
font_03_sfnt_off0000b52c.bin
345bf7167becae3a59d2204c468b2db927fa665c2d401b404890ad56813a8387		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB52C 17292 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.