Malicious PDF — malware analysis report

Static analysis result for SHA-256 c01fcc407a7b30ab…

MALICIOUS

PDF

44.8 KB Created: 2020-09-04 21:55:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-17
MD5: b2143f0ebd4d10f6f906e74ee30e87d1 SHA-1: 61e80207fb661c48a4d47f2a4ccfed725686b54b SHA-256: c01fcc407a7b30abade5abba159b781659c5b3aee027aba50e7dee6f678ff002
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links, many pointing to PDF files hosted on static.usrfiles.com, and one critical link to ttraff.com, which is flagged as a malicious redirector. This suggests a link farm or SEO poisoning attack designed to drive traffic to malicious infrastructure. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=unity+assetbundle+manager In PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://static.usrfiles.com/ugd/b8c837_7eaebefef42b4d12b2474f6936f870e8.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/610d21_cb5b2d013b3c44e398cf78608c3359e8.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/96768c_cf57aea6f136425fb6b0036b56b51b39.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/11b39a_5ced09a383fe49c0a72af953a5d0896f.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/b8c837_84029edf1b3a45da88a7fd3f60b5ca77.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/b8c837_c6d535e08de14c388e95b2ff94021b16.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/857e61_b29a488589074828920e63d60dba5988.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/b8c837_8de2c3f5a3e14d688bca221f8f91ed6d.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/91e123_3f0b04089d834530b08923c56e82a9fc.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0432/3953/8851/files/distance_vs_time_graph_worksheet.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0428/8544/7833/files/futukuletibadomigabu.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0427/6187/9719/files/abstract_reasoning_test_sample.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/53059057271.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0428/5900/4070/files/linear_algebra_with_applications_leon.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000061db.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x61DB 5148 bytes
SHA-256: 9147c533c1d60fef8f12a4ef35ab1eaef755805134faf3818d09a1fd2bf736c4
font_01_sfnt_off00007339.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7339 11400 bytes
SHA-256: e0042bc48bee3a163005e01deea695973cc693fabd7e228370d7d403c47eb096
font_02_sfnt_off000098a1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x98A1 4324 bytes
SHA-256: 9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2

Open this report in the interactive analyzer, or submit your own file for analysis.