Malicious PDF — malware analysis report

Static analysis result for SHA-256 b3e6907fd113a2fd…

MALICIOUS

PDF

42.6 KB Created: 2020-09-20 10:30:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f0e29db8c91d6e160259509bf6dc382b SHA-1: 80a91e5a6a01c5cba5bca3d1c60b2a1fd3dcf89c SHA-256: b3e6907fd113a2fd1b057af55397ce3ef236eeae1ed64a668c9082ac4c314308
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a mass of external links, including a critical redirector link to 'ttraff.club' which is associated with malicious activity. The document body, though heavily obfuscated, contains the text 'Mortal kombat online game unblocked' and the malicious URL, suggesting a lure to a potentially harmful site. The presence of numerous PDF links and the ML classifier's high confidence score further support the malicious nature of this document.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/wix?keyword=mortal+kombat+online+game+unblocked
    • https://4d7e6d47-e170-4cf7-850d-658ecfcd2c0e.filesusr.com/ugd/83d902_fb20da129d6748a0aa775d8179280c7a.pdf?index=true
    • https://b4b68952-e619-438d-9802-5f16204b1f6a.filesusr.com/ugd/1fbf8b_235292a10f9d4a248d7e6d7318e67944.pdf?index=true
    • https://92859396-50d9-4c7a-ada8-97dc4325a79d.filesusr.com/ugd/f08e01_2f4b264631a54c3b9c051da5a013c78c.pdf?index=true
    • https://2ec49f71-b4f5-4667-8d69-6475b29de60d.filesusr.com/ugd/b4bf80_9ced1b251c544ca4963d81b2ddcf8793.pdf?index=true
    • https://a676872d-d146-4188-9806-50e14418fedc.filesusr.com/ugd/8ab72e_0aed117bd0a742d3bd6e2b38e7a9b77a.pdf?index=true
    • https://cdn.shopify.com/s/files/1/0435/9369/5391/files/electronics_components_symbols_and_functions.pdf
    • https://cdn.shopify.com/s/files/1/0430/9050/9975/files/gepujowowamid.pdf
    • https://cdn.shopify.com/s/files/1/0428/8184/3356/files/theme_store_apk_oppo_f5.pdf
    • https://cdn.shopify.com/s/files/1/0431/0689/3985/files/53358251785.pdf
    • https://cdn.shopify.com/s/files/1/0437/3449/9489/files/google_chrome_os_free.pdf
    • https://f3136f7b-8aa1-4193-a01f-870303033bbb.filesusr.com/ugd/81d6a4_566c43f7f2bf45e08307a9dead15569e.pdf?index=true
    • https://512a4a23-1186-4824-aab1-3cae2da953aa.filesusr.com/ugd/95089d_1ffd4b3af9eb45c28a819ec74107b06c.pdf?index=true
    • https://ab8b101d-ea10-455d-8f1a-095971b25ec9.filesusr.com/ugd/ac8c68_efc5a58d7e554f918dca89bcd1238d25.pdf?index=true
    • https://39ed5145-26a6-4d99-9669-2b2940312800.filesusr.com/ugd/bf57b5_430944b976564eeeb0f538910a61c12a.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006711.bin
6e6eae08cf4af646e0ddb222fbba76053642c4f0139108e9b056098326ca3a56		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6711 5288 bytes
font_01_sfnt_off00007902.bin
c7543929666a16a90a3d80ede70bafdbcee2d1d00f822e3083f24fcdf6abdefe		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7902 10792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.