Malicious PDF — malware analysis report

Static analysis result for SHA-256 d249c3e36ed09f82…

MALICIOUS

PDF

37.7 KB Created: 2020-08-31 11:18:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e2a941e76c5ef129cffad31156c04109 SHA-1: 2613085804aef43d3ff9e6fa1bd4386a27475cc4 SHA-256: d249c3e36ed09f821f6faa763ca5bf299705cb4af06bb0920b14c69b66fbbdcd
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a significant number of embedded links, identified as a 'PDF_SEO_LINK_FARM'. One of these links, 'https://ttraff.com/wix?keyword=international+trade+finance+a+practical+guide+pdf', is flagged as a malicious redirector. The ML classifier also strongly indicated maliciousness. The document body appears to be obfuscated or corrupted, but the presence of the malicious redirector and the link farm strongly suggests an attempt to lure users to malicious sites or manipulate search results.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=international+trade+finance+a+practical+guide+pdf
    • https://static.usrfiles.com/ugd/b8c837_1c732696afd849b3b6a42663602a4478.pdf
    • https://static.usrfiles.com/ugd/0a593f_2fe7e057c51f4bb39bedba601de83e9f.pdf
    • https://static.usrfiles.com/ugd/7ff653_0422a0d2692543f6beaf4eafd075582e.pdf
    • https://static.usrfiles.com/ugd/1fbf8b_78da7719583144d4b985bf00de85a7d4.pdf
    • https://static.usrfiles.com/ugd/51c472_829acd91816f47faa5d76e7c3d638a8f.pdf
    • https://static.usrfiles.com/ugd/b8c837_51d76e8191ad4e54acb8116c35b0e87a.pdf
    • https://static.usrfiles.com/ugd/1b8612_d83eed917940451a903c1b0d6e26ccdb.pdf
    • https://static.usrfiles.com/ugd/166c09_a4788eb67d114ab8a079c637e51bdad4.pdf
    • https://static.usrfiles.com/ugd/b8c837_c7d1ec383439454f8aa18a8951e5aa54.pdf
    • https://static.usrfiles.com/ugd/516574_68d2709796eb45759e8b01a5d0fc65b6.pdf
    • https://cdn.shopify.com/s/files/1/0429/8804/4442/files/aula_de_violo_para_iniciantes_em.pdf
    • https://cdn.shopify.com/s/files/1/0430/5698/8317/files/32881671379.pdf
    • https://cdn.shopify.com/s/files/1/0466/7752/4645/files/universal_audio_ox_reactive_amp_attenuator_manual.pdf
    • https://cdn.shopify.com/s/files/1/0429/9292/6883/files/21634706159.pdf
    • https://cdn.shopify.com/s/files/1/0434/2985/5393/files/gastrointestinal_tract_diseases.pdf
    • https://cdn.shopify.com/s/files/1/0443/5856/6044/files/concepto_de_riesgo_financiero.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://cdn.shopify.com/s/files/1/0429/9292

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000054c8.bin
5cac6e633ebdd6d0da61663932f88eda1b3edec8f0b3b34e8f7311d1b51ef4ff		 pdf-font-stream PDF embedded font (sfnt) at offset 0x54C8 5084 bytes
font_01_sfnt_off0000661a.bin
345670a4750e6be961ebdddcbd13130e882a2523c73b22f81d2f99da1c8a7d11		 pdf-font-stream PDF embedded font (sfnt) at offset 0x661A 10444 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.