Malicious PDF — malware analysis report

Static analysis result for SHA-256 afa0735fad02cb9c…

MALICIOUS

PDF

52.7 KB Created: 2020-08-30 08:18:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: dcf3af6dab6868278a50da0804232476 SHA-1: c6a16d8a9a8eddf1abcf3b62bac5e79e3e2fc37c SHA-256: afa0735fad02cb9c13d3d7f93e341f68b6cfe260515c64e787c4c77617dc4eb6
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains numerous embedded links, with one specifically pointing to a known malicious redirector. The document body, though heavily obfuscated, contains the URL 'https://ttraff.cc/wix?keyword=poe+syndicate+guide+for', suggesting a lure to a malicious site. The presence of a large number of external PDF links further indicates a link farm designed to direct users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=poe+syndicate+guide+for
    • https://static.usrfiles.com/ugd/b47706_4e0527e7349d497697aba902e1c493f1.pdf
    • https://static.usrfiles.com/ugd/2c8d66_8e1378401ace4e2ba79a386166b2f400.pdf
    • https://static.usrfiles.com/ugd/409ca8_a0848643646e4285aa6ac24b6c123496.pdf
    • https://static.usrfiles.com/ugd/de60da_4e519b76fca64a799111d660112d0814.pdf
    • https://static.usrfiles.com/ugd/b8c837_d6247f754daa4a7dbd816da461b6224e.pdf
    • https://static.usrfiles.com/ugd/aef5b7_50210d3e671e46e290e47ac343cd8478.pdf
    • https://static.usrfiles.com/ugd/b8c837_78dc4acaef3a41d4bac33137316ff669.pdf
    • https://static.usrfiles.com/ugd/b8c837_c73cfb7d4e44477f809a204966db6af4.pdf
    • https://static.usrfiles.com/ugd/b8c837_a6ac94d7694e49bdafb1d80a59324829.pdf
    • https://cdn.shopify.com/s/files/1/0435/7944/1307/files/spreadsheet_app_for_ios_9._3._5.pdf
    • https://cdn.shopify.com/s/files/1/0437/5658/5114/files/zukavi.pdf
    • https://cdn.shopify.com/s/files/1/0428/9154/2681/files/19075726489.pdf
    • https://cdn.shopify.com/s/files/1/0433/4141/4555/files/free_premium_templates_for_blogger.pdf
    • https://static.usrfiles.com/ugd/d162e3_e2a4cc83662647b982c51bf2b70a353a.pdf
    • https://static.usrfiles.com/ugd/43d598_91e4161b880c41a0a44f580a842a89dd.pdf
    • https://static.usrfiles.com/ugd/b8c837_f7a807859dc34f56aad9b7afb7e94efb.pdf
    • https://static.usrfiles.com/ugd/b8c837_af0c71f80e8e45a5bc124629d98c6080.pdf
    • https://static.usrfiles.com/ugd/19103d_a83c4c4275e2446eb6c381c5555b8cdf.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://static.usrfiles.com/ugd/b8c837_af0c71f8

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00009051.bin
68a8967379fc6e0863963c7cc96519f17d80d3d43524bfb15a6c569c722349b6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9051 5260 bytes
font_01_sfnt_off0000a244.bin
32c9849a604d4978e90fbbc4de80170c26e19971c0c5dc3efcddf0e7fc1a9c1a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA244 10588 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.