Malicious PDF — malware analysis report

Static analysis result for SHA-256 d094f1fece3a454f…

MALICIOUS

PDF

96.3 KB Created: 2020-10-25 17:46:58 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3d1284ef9e583d13b0489b995b7d97aa SHA-1: 7cfa661ded48805ad91ad0523450dc4eb473ea44 SHA-256: d094f1fece3a454fc168524eae2bdf03c06d7447f57c5a7617c6f30a3d904efc
162 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous links to external PDF files, a common tactic for SEO poisoning and redirecting users to malicious sites. One critical heuristic identified a link to known malicious redirector infrastructure, specifically 'ttraff.cc'. The document body, though heavily obfuscated, contains the URL 'https://ttraff.cc/123?keyword=el+desacuerdo+ranciere+pdf', indicating a likely attempt to lure users into clicking this malicious link. The presence of embedded URLs and the ML classifier's high confidence score further support this assessment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/123?keyword=el+desacuerdo+ranciere+pdf
    • https://nevitasez.weebly.com/uploads/1/3/4/3/134305442/sepowumewefaxa_jetipo.pdf
    • https://finazodaxuvoj.weebly.com/uploads/1/3/2/6/132682535/4930821.pdf
    • https://bubixoduxufito.weebly.com/uploads/1/3/1/0/131070588/movimifatizujil_dimatesagegoja.pdf
    • https://sibakixode.weebly.com/uploads/1/3/2/8/132814768/bigusak.pdf
    • https://xijonezamo.weebly.com/uploads/1/3/1/4/131407630/nuninexitixip.pdf
    • https://cdn-cms.f-static.net/uploads/4369632/normal_5f9179173a058.pdf
    • https://cdn-cms.f-static.net/uploads/4374024/normal_5f93ff5cb2f01.pdf
    • https://cdn-cms.f-static.net/uploads/4367275/normal_5f8f72230424d.pdf
    • https://cdn-cms.f-static.net/uploads/4375886/normal_5f8bb97f47741.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/0288e8ad-4dd4-4041-b9ab-a8065c72f493/24608380992.pdf
    • https://uploads.strikinglycdn.com/files/41b4b17c-b7b5-4aa6-a1ca-f8c3c1bee513/80857326298.pdf
    • https://uploads.strikinglycdn.com/files/c7628a00-2570-48da-a7e7-935bd387ff39/8859289180.pdf
    • https://uploads.strikinglycdn.com/files/b1ff1113-dd22-4036-b6ee-a0a1705bf458/80336070080.pdf
    • https://uploads.strikinglycdn.com/files/d72d6e9f-52c1-46fc-b058-a5d75eee60c3/87962285819.pdf
    • https://uploads.strikinglycdn.com/files/692fab77-d6a7-455c-ae8f-ad5b76505bbc/.pdf
    • https://uploads.strikinglycdn.com/files/a56456c3-b206-45f2-90ae-f042cdf1fefe/si_j_tais_un_homme_tab.pdf
    • https://uploads.strikinglycdn.com/files/b8420809-4d9e-42c0-8f3a-8bebab599d92/68361313402.pdf
    • https://s3.amazonaws.com/zirojopemup/helping_verb_exercises_with_answers.pdf
    • https://s3.amazonaws.com/mijedusovineti/names_of_human_body_bones_filetype.pdf
    • https://s3.amazonaws.com/pazifetanegapu/kulenelawoxulipanipoworu.pdf
    • https://s3.amazonaws.com/sulasatevirexo/blues_ukulele.pdf
    • https://s3.amazonaws.com/zaxuledo/94201142817.pdf
    • https://s3.amazonaws.com/lunojol/88432402064.pdf
    • https://s3.amazonaws.com/kavitokolezub/casting_crowns_who_am_i_sheet_music.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_007_off0001569c.bin
aac0bcbeacce38ab761f869cb9767a6ab2e95197077ce305aefa1a34f1142d55		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1569C 17844 bytes
font_00_sfnt_off00011cf1.bin
480e97d30c2f103b6d9b63724674289c5ef78e6b0ff1ef7a5308a82c3d9fa6c4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11CF1 5108 bytes
font_01_sfnt_off00012e5c.bin
039d87ffc30a96ddb5423f683c9977f86a14c377b570e6f71afda7013c3e9ae4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12E5C 12296 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.