Malicious PDF — malware analysis report

Static analysis result for SHA-256 f604ea5b3c0dcb81…

MALICIOUS

PDF

42.6 KB Created: 2020-09-18 13:39:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f30fd85e284fbf717430df8149d0fcb3 SHA-1: 5e1c6b5eb6b7e2e62beea069d2635ea2c9af09a2 SHA-256: f604ea5b3c0dcb81fc36ec3098963076f4dcbf26a2bb1514c8e57cfd2627641c
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

This PDF document contains numerous embedded links, including a critical redirector link to 'ttraff.me'. The document body, though heavily obfuscated, contains references to the target URL and other PDF links, suggesting a link farm or redirection strategy. The ML classifier strongly flagged this PDF as malicious, indicating a high likelihood of it being used for malicious redirection or to host further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=mario+kart+ds+action+replay+codes+europe
    • http://files.maarshainc.com/uploads/1/3/2/6/132682897/3e76d062.pdf
    • http://nawobu.chs2007.com/uploads/1/3/1/8/131856772/tefaseligofolow.pdf
    • http://sikeso.richardbunningbooksandreviews.com/uploads/1/3/2/3/132302987/2630201.pdf
    • http://riloxa.yucaipafootball.org/uploads/1/3/1/6/131606159/2389331.pdf
    • http://files.wosherbalhealth.com/uploads/1/3/1/3/131380627/4a1e5475.pdf
    • http://dalita.myerstoolrental.com/uploads/1/3/2/7/132741100/pafuwafu-kixiwid-subanagogarafer-wosotisox.pdf
    • http://files.ycvideos.com/uploads/1/3/1/4/131437379/162a8.pdf
    • http://daruguv.veronicaholisticteacher.com/uploads/1/3/1/3/131398020/5074937.pdf
    • https://591baeea-e286-440b-a44e-c0ec164c7d58.filesusr.com/ugd/fac845_0ebd0757a1604072ab5cf8e8e4451cf8.pdf?index=true
    • https://a1e942f0-0097-433b-90ee-8ddddf6ce950.filesusr.com/ugd/a4ea6c_5606b4776c1146bf94c4575bcf724ebe.pdf?index=true
    • https://2bd4bfd1-81ae-4682-a58c-a30909156c50.filesusr.com/ugd/5c9621_615fcf5999bb481d81b388cb314db5eb.pdf?index=true
    • https://724324f6-bd15-46ea-90d9-497037e20750.filesusr.com/ugd/dec231_50924e0292cb429e9daa3b7745806ce9.pdf?index=true
    • https://5358ab03-c4f8-4e19-a1dc-4f2062445962.filesusr.com/ugd/c79b1c_71558eebde3340ff9d1c7666242c1e37.pdf?index=true
    • https://b410d04f-a36c-4497-85a9-d3e6946c9224.filesusr.com/ugd/575fb0_e93cac730ebc45f4aad7024520f76bdb.pdf?index=true
    • https://4cbfd9bf-34ac-4ef0-88b8-53875e05607b.filesusr.com/ugd/24deb6_418d0ec0948f41aba894d29c47cf8886.pdf?index=true
    • https://44de8132-7cc1-410d-a0ed-1a63286e82a5.filesusr.com/ugd/c618e9_3350659cd43544e1b65505b38f6a9595.pdf?index=true
    • https://31e27e6b-33c6-4780-8f8a-a1f09fde52b3.filesusr.com/ugd/77941b_684fc98a444a49499e49c5e7b6422783.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://31e27e6b-33c6-4780-8f8a-a1f09fde52b3.filesusr.com/ugd/77941b_68

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000068ce.bin
4b2a415fb4bec6b07cbf7c483835a3d91714b828f14ccc6a4a4b12fd861ab4de		 pdf-font-stream PDF embedded font (sfnt) at offset 0x68CE 5236 bytes
font_01_sfnt_off00007ac4.bin
80a6f75bda61c271d891f8c6505e17eaae42e54d346dc9ac3fa8bb5424348753		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7AC4 10168 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.