Malicious PDF — malware analysis report

Static analysis result for SHA-256 d41113312d032402…

MALICIOUS

PDF

37.9 KB Created: 2020-08-30 16:50:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ce55d06f8484fd82f2109c8ab364a018 SHA-1: 206775f114f21a19ea67d2a245a40aef19b5f600 SHA-256: d41113312d032402b917dc775be71de0d3918352531390d67bd2be7b3840e7b2
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links, many pointing to external PDF files, which is indicative of a link farm or SEO poisoning attempt. One of the primary links, https://ttraff.com/wix?keyword=akran+de%25C4%259Ferlendirme+%25C3%25B6rne%25C4%259Fi, is flagged as a malicious redirector. This suggests the document's purpose is to direct users to malicious infrastructure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=akran+de%25C4%259Ferlendirme+%25C3%25B6rne%25C4%259Fi
    • https://static.usrfiles.com/ugd/61f964_a78301933c9d484d88d87af1e43b1833.pdf
    • https://static.usrfiles.com/ugd/69b86f_5b9b9007f01540a1a90068579dbcdc1a.pdf
    • https://static.usrfiles.com/ugd/cdb50c_52025aa13b0649ab8ebabfe9947c1b90.pdf
    • https://static.usrfiles.com/ugd/0d089b_03f49765525d4886bc9d53a90b621888.pdf
    • https://static.usrfiles.com/ugd/10e3af_7b6e4ff82f85409b99bbfdf60e6f0d5d.pdf
    • https://static.usrfiles.com/ugd/9c0842_24f6d53fbc62469d8984fe968f7122cb.pdf
    • https://cdn.shopify.com/s/files/1/0433/4295/4651/files/93359653017.pdf
    • https://cdn.shopify.com/s/files/1/0433/5501/3275/files/arteritis_de_takayasu.pdf
    • https://cdn.shopify.com/s/files/1/0433/4397/0463/files/addition_and_subtraction_of_radical_expressions.pdf
    • https://cdn.shopify.com/s/files/1/0431/2478/5313/files/44113435172.pdf
    • https://cdn.shopify.com/s/files/1/0432/5064/7204/files/93523854339.pdf
    • https://static.usrfiles.com/ugd/b8c837_c932625d6e78453ca8ecbc84a2ade8ea.pdf
    • https://static.usrfiles.com/ugd/724bd4_b42b04b0591b433681df20c8158aaf80.pdf
    • https://static.usrfiles.com/ugd/3f0e57_4d4cc921c18943b4a0eb69b7775913e5.pdf
    • https://static.usrfiles.com/ugd/384ea4_4a48f22e836444dca2cda8177e5c6fe8.pdf
    • https://static.usrfiles.com/ugd/dcfb95_bdb96cc4e9c54fecb6224c2738b8d34a.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000053d9.bin
5ccb4e523eab91b0aa6b2419eca3a4bb5948b279d0cee9480542c103ca6c3277
pdf-font-stream PDF embedded font (sfnt) at offset 0x53D9 5216 bytes
font_01_sfnt_off00006539.bin
d08acac776ade1021263de37b27b51ae06faf65c36bd3d95fbbb82091b670b78
pdf-font-stream PDF embedded font (sfnt) at offset 0x6539 11576 bytes