Malicious PDF — malware analysis report

Static analysis result for SHA-256 f23d8a68de826014…

MALICIOUS

PDF

53.5 KB Created: 2020-10-27 05:10:25 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-17
MD5: bbd02bb24b99816dbcef9e247c0fca10 SHA-1: 12364ec7e5312748f01bd0b32d646b837d59ee47 SHA-256: f23d8a68de826014af44775845cedb5eaf1ab9fda1d5887c7cbaf716637bf82b
154 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link to a known malicious redirector, ttraff.me, which is disguised as a 'Tory Burch black Friday discount'. This redirector leads to a link farm of numerous other PDFs, suggesting a SEO poisoning or traffic generation scheme. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/pify?keyword=tory+burch+black+friday+discount In PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/taturi/digital_marketing_interview_questions_2018.pdfIn PDF document text
    • https://s3.amazonaws.com/subud/turivizizowevuniremim.pdfIn PDF document text
    • https://s3.amazonaws.com/peveziwoguxuzam/isotopic_abundance_worksheet.pdfIn PDF document text
    • https://s3.amazonaws.com/pivetuzadujo/sanisefejazedipelifu.pdfIn PDF document text
    • https://s3.amazonaws.com/vatosolikijike/40452384450.pdfIn PDF document text
    • https://s3.amazonaws.com/rebesudanolo/assessable_spouse_election_form.pdfIn PDF document text
    • https://s3.amazonaws.com/vabedafozo/55063657756.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d82a470a-1230-4a92-bb64-38c5206d751a/71632048311.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/93aa6dda-8a73-4bd9-a3a6-3fe34cd88ea2/74164510829.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0434/0675/3948/files/atomic_structure_worksheet_chart.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0496/1455/3252/files/monographic_exhibitions_and_the_history_of_art.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0499/6566/2357/files/non_current_assets.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0266/8445/7146/files/math_puzzle_printable_worksheets.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6c30a1e3-9027-4ed1-bc57-952d7c85892f/xonumiguxofe.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1f6a60bc-4226-45e8-94e6-8e9014124868/ap_literature_exam_study_guide.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0432/0319/9138/files/dragon_city_mod_apk_unlimited_coins.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0440/6847/0936/files/resevatexedidoninamo.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0430/7877/9047/files/mixovaduwe.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000750c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x750C 5128 bytes
SHA-256: 4edac00c4022d556a2ec5d677086105eda706ea9e3a301bda4fd82d2b3c559b4
font_01_sfnt_off0000866c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x866C 3564 bytes
SHA-256: dd4941b36412dcdf7bd594b561be801d2d9771f553a036411b8d253b48ac76be
font_02_sfnt_off00009478.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9478 11180 bytes
SHA-256: 9f3f4ef40ae7dfb3112916f5c27107dcd60e04485ccc4e2425942b488fb07624
font_03_sfnt_off0000ba74.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBA74 4324 bytes
SHA-256: 4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3

Open this report in the interactive analyzer, or submit your own file for analysis.