Malicious PDF — malware analysis report

Static analysis result for SHA-256 d0c1fa58feba869b…

MALICIOUS

PDF

47.6 KB Created: 2020-11-02 20:17:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-14
MD5: 12238c5f6065eef176ec3d4047ddb4d4 SHA-1: 8c7f64b3bdbb25cb7c2608eebaeb1292717b4340 SHA-256: d0c1fa58feba869bbec196bcda9b68fb8a81218957c4393c1295f5fe37343df4
194 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The sample is a PDF document that contains a lure for an advance-fee scam, indicating a phishing attempt. It embeds a link to a malicious redirector, https://ttraff.club/123?keyword=verizon+fios+mobile+app+for+pc, which is likely used to deliver a secondary payload or lead the user to a fraudulent site. The ML classifier strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/123?keyword=verizon+fios+mobile+app+for+pc In PDF document text
    • https://gupaxapofigovi.weebly.com/uploads/1/3/4/3/134356466/kezebegevixibak.pdfIn PDF document text
    • https://sufusazowuk.weebly.com/uploads/1/3/4/3/134311692/xafeviju-pinito-gakid.pdfIn PDF document text
    • https://gemenudotipetal.weebly.com/uploads/1/3/2/6/132695720/5463cfdf2c6b85f.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://cdn.shopify.com/s/files/1/0501/5581/5093/files/old_fairy_tales.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0430/4312/7447/files/77688821371.pdfIn PDF document text
    • https://s3.amazonaws.com/regovadeje/petsafe_rf-275_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1542047b-c679-49fe-bb0b-2d7ad55148f7/sopetepuluravulu.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0431/1056/4002/files/77632703763.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0268/7808/3255/files/19161568202.pdfIn PDF document text
    • https://s3.amazonaws.com/firigugixujotov/35959897722.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3ff18ea1-0e86-4e7a-9e4c-d9e04613f154/kafojugigezalelawi.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0484/9598/4795/files/84435457235.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0438/7943/2347/files/bluford_high_series_set.pdfIn PDF document text
    • https://s3.amazonaws.com/sepawi/bisepegizurimasamolog.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0501/8062/0467/files/73062657828.pdfIn PDF document text
    • https://s3.amazonaws.com/wutezigojuxi/wunusasiwinume.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006d6c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6D6C 5024 bytes
SHA-256: be72e0cb7f9f6b5bf46910ac5d80ee4578e8f26a04dc1de8ced87d009f4b374d
font_01_sfnt_off00007e5a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7E5A 10668 bytes
SHA-256: 9c054b12317cf8b99cd697905fb2c8794a544f240d15e090a49eb3b8960ed6a4
font_02_sfnt_off0000a300.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA300 4324 bytes
SHA-256: cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34

Open this report in the interactive analyzer, or submit your own file for analysis.