Malicious PDF — malware analysis report

Static analysis result for SHA-256 d319a08a201f4d1f…

MALICIOUS

PDF

40.8 KB Created: 2020-08-30 21:52:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fa780ac692205bfb70eb5c8c31935fe2 SHA-1: cc507cd7d356981eb0c65102f815c7eb2cb9e273 SHA-256: d319a08a201f4d1ffa7b97d3f1ae6f7c884d2de3debbd6d8fc70f3908c554c58
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a mass of external links, with one specifically identified as a malicious redirector. The primary malicious URL is https://ttraff.cc/wix?keyword=raja+rani+movie+online. The document body contains obfuscated text and references to 'raja rani movie online', suggesting a lure for potentially malicious content. The presence of numerous links to static.usrfiles.com, while flagged as benign, contributes to the overall link farm characteristic.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=raja+rani+movie+online
    • https://static.usrfiles.com/ugd/dd4472_25447012e58e4f218bcc147fce2bda1e.pdf
    • https://static.usrfiles.com/ugd/dc8a8e_f03988bab4594b7696c3b815436959de.pdf
    • https://static.usrfiles.com/ugd/b8c837_50d717412911452c9e850a5bb5fc6dc9.pdf
    • https://static.usrfiles.com/ugd/8b49c6_d97df66c7b6e41dcb3935ef3423b0f28.pdf
    • https://static.usrfiles.com/ugd/ee9d3f_4d95a094deb24fd8ace2bc7bb67e1715.pdf
    • https://static.usrfiles.com/ugd/aef5b7_922e16cd08554448af668c45b810d808.pdf
    • https://static.usrfiles.com/ugd/bdeb4c_63ed93716fba4a0a80ac164fd8de4713.pdf
    • https://static.usrfiles.com/ugd/b8c837_685c5de96c4c4fb7b9e312da8da0a627.pdf
    • https://static.usrfiles.com/ugd/09c3c7_01f5359bb10d49ee9af5127552994358.pdf
    • https://static.usrfiles.com/ugd/b5aed9_d6ef10628a604631b984d8156d1fb5fe.pdf
    • https://static.usrfiles.com/ugd/b8c837_82516dd53b0c46798126c751bc134502.pdf
    • https://static.usrfiles.com/ugd/299074_4a7ffe7a99c043f597c2ad6e219e5b0a.pdf
    • https://static.usrfiles.com/ugd/b8c837_1a1696d41ac94ba9a488f2d11346b43b.pdf
    • https://static.usrfiles.com/ugd/9c3693_f58952e17782424fb11309f73f27eae6.pdf
    • https://static.usrfiles.com/ugd/a18aa6_6339673ca90944c9a878627c4b08065f.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004d98.bin
3cbfb030b283e30ac51bf069b0fe811be2ca5596a0075b14b412bf88ee9af7a4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4D98 4796 bytes
font_01_sfnt_off00005ddf.bin
d1dcd64a01abdce1c6a719034bbc139f883dd92c365ba24b277851839e1c6244		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5DDF 10192 bytes
font_02_sfnt_off000080ec.bin
c41fc46809d2260d2d1a821cef6bb00dae560fdbad380da94a93f29d012df54e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x80EC 16164 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.