Malicious PDF — malware analysis report

Static analysis result for SHA-256 bb09911bf3e9db29…

MALICIOUS

PDF

42.5 KB Created: 2020-08-31 08:51:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 350c3e3a2d09f47eac52d1b8c57c2f96 SHA-1: 471d3f5738bed81b8dd2882e09a20ed0a6c3d867 SHA-256: bb09911bf3e9db2997011bfa60c4241d2a4ee7d4fde495e1f7abeb0f9248ec5e
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links, with one specifically pointing to a known malicious redirector infrastructure at 'https://ttraff.com/wix?keyword=old+school+runescape+misthalin+mystery'. The ML classifier also strongly indicated maliciousness. The document body appears to be heavily obfuscated or corrupted, but the presence of the malicious URL and the link farm heuristic suggest a phishing or redirection attack.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=old+school+runescape+misthalin+mystery
    • https://static.usrfiles.com/ugd/de3d83_93fa8e7ed0c147678deb1225e718df51.pdf
    • https://static.usrfiles.com/ugd/ff2e72_cb45766a816d4f139d721fec7a65cda1.pdf
    • https://static.usrfiles.com/ugd/3b7182_49c5f89192574a9c87b33b32855e5315.pdf
    • https://static.usrfiles.com/ugd/b8c837_6c4be4313a44495b99655cff6b94bfca.pdf
    • https://static.usrfiles.com/ugd/b8c837_e59af30eb9f6470893edae8e0cee8a7e.pdf
    • https://cdn.shopify.com/s/files/1/0431/0764/7639/files/panchatantra_stories_in_kannada.pdf
    • https://cdn.shopify.com/s/files/1/0432/5870/8118/files/tovamima.pdf
    • https://cdn.shopify.com/s/files/1/0437/0766/2490/files/batman_arkham_city_pc_rar.pdf
    • https://cdn.shopify.com/s/files/1/0430/4823/9257/files/unir_dos_windows.pdf
    • https://cdn.shopify.com/s/files/1/0430/0469/0581/files/62188962059.pdf
    • https://static.usrfiles.com/ugd/4725f1_da97c0dc7eba45c08f166005920a3ab8.pdf
    • https://static.usrfiles.com/ugd/b8c837_04441d11a284475b909021614dadf60f.pdf
    • https://static.usrfiles.com/ugd/a4e402_febab50c6f23440a9e4b288008cef4ae.pdf
    • https://static.usrfiles.com/ugd/37428b_b616daf2924e4b8fabdf5ad723a9d28d.pdf
    • https://static.usrfiles.com/ugd/0d089b_09195266de3a4b17ad38c8103d20b8fe.pdf
    • https://static.usrfiles.com/ugd/bae363_e6ad1948d88447578eea31d6949b30f4.pdf
    • https://static.usrfiles.com/ugd/913720_3aa754efa5944281bcecc36149bcf006.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006800.bin
33ac97d47a4f68366a7662cce40fd45ad968195dff4bd21029a639eef6b7f95d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6800 5444 bytes
font_01_sfnt_off00007a56.bin
da4d5b50289e6d83669f2b309dbd45c5d60eff6647f604b9cf2d7dd57c794eaa		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7A56 10344 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.