Malicious PDF — malware analysis report

Static analysis result for SHA-256 b18b676b70e33057…

MALICIOUS

PDF

45.7 KB Created: 2020-10-28 14:39:17 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-14
MD5: f48dbee9f548f5c26e9019fbfed30bdf SHA-1: 8670bdd0d2c117c892a600e44a8336e25a381971 SHA-256: b18b676b70e33057669b81008f04b95948120fcfb1e4c3d97d69f7b509272fec
94 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link that is flagged as a malicious redirector, pointing to ttraff.ru. The document body, though heavily obfuscated, contains text related to a driver license manual and the malicious URL. The ML classifier strongly indicated maliciousness, suggesting the primary goal is to redirect the user to a harmful site.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/123?keyword=arizona+driver+license+manual+pdf In PDF document text
    • https://cdn-cms.f-static.net/uploads/4369647/normal_5f995db1744fa.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408858/normal_5f992ef11841f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384851/normal_5f8f92400023c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369336/normal_5f95becca60a8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365536/normal_5f889d442b19d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4393883/normal_5f963fe0cfe96.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4403422/normal_5f93f21c1d37d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368244/normal_5f87edf76696f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4378853/normal_5f902e038acc4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369503/normal_5f8f54fcb426b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4378613/normal_5f983d01b51ea.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366402/normal_5f8763e49518f.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/c29c2567-0a8a-437f-a3af-3d00d2532a8f/bepirexifumaxumarin.pdfIn PDF document text
    • https://s3.amazonaws.com/bubodeliza/rofof.pdfIn PDF document text
    • https://s3.amazonaws.com/pazifetanegapu/47531779748.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2045c29c-b4e5-414f-bb0a-eec595dd6ba4/figaselitujitovi.pdfIn PDF document text
    • https://s3.amazonaws.com/mudurixo/medelexozedefekevebuwe.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9236efdd-f77f-4d8d-a46a-1172876df684/93829877483.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/26e6cf4a-cd85-459e-82b5-ae66ad043721/ping_g10_irons_for_sale.pdfIn PDF document text
    • https://s3.amazonaws.com/gedimuta/attachment_theory_of_children.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a66bc1b9-5ca6-4ae1-a4e3-a76c38a8e964/40571595034.pdfIn PDF document text
    • https://s3.amazonaws.com/jemazejodep/24095220252.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000073c2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x73C2 5400 bytes
SHA-256: 8dc1ab0db95ef2f1f3ed1697f4c53163fefff8aa85de84cf8b19410d19a445f5
font_01_sfnt_off0000861b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x861B 10408 bytes
SHA-256: d603b48c975563bcd8754b130c97e193baf32e79a097ea0a1951a9ceed3d3f0f

Open this report in the interactive analyzer, or submit your own file for analysis.