Malicious PDF — malware analysis report

Static analysis result for SHA-256 dec3eef98f083a5d…

MALICIOUS

PDF

50.7 KB Created: 2020-09-17 23:12:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 387bfcea914d4aaf7ce65c198fcae43e SHA-1: 0dd54049ccc5078351a30968b30eb8aa1b01f967 SHA-256: dec3eef98f083a5df0cd708c14374181392799e05738fb94659707f7281b3d6d
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links, with the primary redirector URL being `https://ttraff.link/wix?keyword=z-transform+table+with+roc`. This URL is flagged as malicious. The document also exhibits characteristics of a link farm, with many external PDF links, suggesting a coordinated effort to distribute malicious content. The ML classifier strongly supports the malicious verdict.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/wix?keyword=z-transform+table+with+roc
    • http://xekip.lsvlmassagetherapy.com/uploads/1/3/1/0/131069759/pijisup_luresosisinusar_fijotup.pdf
    • http://mobevolo.red2green.org/uploads/1/3/1/4/131406558/5854583.pdf
    • http://files.magicstorybooks.com/uploads/1/3/0/7/130776131/5d97c.pdf
    • http://gomis.matheascatering.com/uploads/1/3/1/0/131070719/vosomabo-midalexogav-jalekimexe-vupup.pdf
    • https://7ccdab86-2a3d-426a-9810-13e9afb206e6.filesusr.com/ugd/6c032c_06ab7017fd4f4df4a6b54e8f854dce92.pdf?index=true
    • https://64c74c20-38ff-4d95-94c6-c3906dc3200e.filesusr.com/ugd/0a51c1_e8d182a22e8a40f19f871330334f7669.pdf?index=true
    • https://42afa59b-367b-4bd3-b5c7-3eef62c36845.filesusr.com/ugd/a9248e_d96c42a1d1764d79b02e9bc0f212c999.pdf?index=true
    • https://7f81c639-ab90-4ae3-bb5c-3cfd00d80e78.filesusr.com/ugd/fb41f9_c3f2c624f20e443f98ce4c6f44cb0291.pdf?index=true
    • https://19cd2cb9-f5d9-4b82-b687-e1e79f81460d.filesusr.com/ugd/735189_90435cb3c95a4679a1958d700353ad4f.pdf?index=true
    • https://0ff9ad6f-19f5-4311-a682-ac74278ad581.filesusr.com/ugd/b0cd75_15f2d454799c4b199e73c17c74335a35.pdf?index=true
    • https://7df690b8-57a3-4579-afe9-07968215f5c0.filesusr.com/ugd/d19ca0_0eb49c9fa8b4415f97f4431f2ac16c78.pdf?index=true
    • https://8d497bbb-090b-4f14-8883-c1a574f1c22a.filesusr.com/ugd/dcc11b_faf5283e86a644c5a2bb84bbd02cd6b8.pdf?index=true
    • https://5afb8b68-9058-409e-9396-e997c7789f12.filesusr.com/ugd/5e8de6_d738cb5305ef469e803e4310a76ec062.pdf?index=true
    • https://a59e745b-640c-4c2f-b1d7-978a370052c7.filesusr.com/ugd/0182ef_d169abf10d6640fb9cfb6659284b705e.pdf?index=true
    • https://40c10260-9432-4e7e-a0f2-914682cbbdbe.filesusr.com/ugd/e1d12c_d75decf890f945f6a883186f665d580d.pdf?index=true
    • https://11d97126-fdc8-4b46-b56c-695a92232a5b.filesusr.com/ugd/9e41f0_faf5d09cfc7e406dae714362d56fab77.pdf?index=true
    • https://a09b8751-affe-430f-a842-7957a58a16e4.filesusr.com/ugd/7f614e_b3459a76b96e408bb900dcd450005542.pdf?index=true
    • https://eafac987-674a-4130-8c30-8a6a892d235e.filesusr.com/ugd/c8df25_1b793da36bdf4842b4057e2de9e413b5.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://a09b8751-affe-430f-a842-7957a58a16e4.filesusr.com/ugd/7f

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000069b5.bin
5e5dd30bbcf02d320fd33f50724e331cc8ccfe7c136cf174b70902bda3037467		 pdf-font-stream PDF embedded font (sfnt) at offset 0x69B5 5340 bytes
font_01_sfnt_off00007bce.bin
6a2ef7da2f7128facdf55c7faaa5467bbda8625bcabc469458a533cbda34da77		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7BCE 14080 bytes
font_02_sfnt_off0000a894.bin
52db30b66cfb76898988bc7c6ed152514c301740808ab95bec9c68e49df23550		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA894 16036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.