Malicious PDF — malware analysis report

Static analysis result for SHA-256 ae6f3f83b0495e68…

MALICIOUS

PDF

60.7 KB Created: 2020-08-25 14:51:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f1390b8d75822150028c77d27cab5e99 SHA-1: 72832e7cab48f9265168e02ec2cc046b12940fd4 SHA-256: ae6f3f83b0495e6897518919597a5fc6364df7c062c53c863a518b2685d8631d
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a link to a known malicious redirector, ttraff.com, which is designed to lead users to further malicious content. The document body, though heavily obfuscated, contains text related to a 'clone trooper helmet template' and a URL that appears to be part of a link farm, suggesting a lure to download further content. The ML classifier strongly indicated maliciousness, and the presence of numerous external links points towards a distribution or phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=clone+trooper+phase+1+helmet+template
    • http://files.wecanmarryu2.services/uploads/1/3/0/9/130969433/gawuraxu.pdf
    • http://papijidef.rrgmarketing.com/uploads/1/3/1/6/131637254/6400751.pdf
    • http://files.lisadring.com/uploads/1/3/2/6/132682820/6426892.pdf
    • http://files.awwalsh.co.uk/uploads/1/3/2/7/132741136/vimekuzot-fojesuwadur-jomijetogi-jaletoju.pdf
    • http://files.naiadflowyoga.com/uploads/1/3/0/7/130776268/3470908.pdf
    • https://cdn.shopify.com/s/files/1/0427/4873/9740/files/zedejijanugani.pdf
    • https://cdn.shopify.com/s/files/1/0440/9052/3813/files/visimugomajegaxoz.pdf
    • https://cdn.shopify.com/s/files/1/0431/4624/8358/files/mediralabupurenurimiviv.pdf
    • https://cdn.shopify.com/s/files/1/0433/7870/4536/files/bill_mollison_permaculture.pdf
    • https://cdn.shopify.com/s/files/1/0433/4374/1083/files/cement_brick_making_process.pdf
    • https://cdn.shopify.com/s/files/1/0434/4443/7144/files/24918364613.pdf
    • https://cdn.shopify.com/s/files/1/0429/4151/3894/files/gana_balachander_song_mp4.pdf
    • https://cdn.shopify.com/s/files/1/0432/2017/2960/files/gaxuresidexaxavexokukuna.pdf
    • https://cdn.shopify.com/s/files/1/0429/5943/7975/files/83025865960.pdf
    • https://cdn.shopify.com/s/files/1/0436/8872/2597/files/ggplot2_bar_plot.pdf
    • https://cdn.shopify.com/s/files/1/0434/0881/8333/files/evaluating_limits_worksheet_answers.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b12f.bin
7d851887421d7789a10a0c1cb853b2e6f3b2b7ebea87b5401e86175fdd775a28		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB12F 5016 bytes
font_01_sfnt_off0000c20c.bin
96dcf74719f213e0154564f4b746cedbb776dddb9ae9b0975fb19337749433cd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC20C 10352 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.