Malicious PDF — malware analysis report

Static analysis result for SHA-256 f70b0ce5bd8bc774…

MALICIOUS

PDF

41.2 KB Created: 2020-08-31 05:51:24 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f67675b326672e21dd5786b0dae828b1 SHA-1: 82b7e778ebcdd42b7b8d9837c0bcf6c0a3412823 SHA-256: f70b0ce5bd8bc77406be38523ae8c156e25bfde30d3be3a3ee02cba76b8dfe21
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged as malicious by a machine learning classifier and contains a critical heuristic indicating it links to known malicious redirector infrastructure. Additionally, it exhibits characteristics of a PDF link farm, with numerous embedded URLs pointing to external resources. The primary malicious URL identified is 'https://ttraff.com/wix?keyword=api+crusader+vs+summit+viper', which is likely used to redirect users to a malicious site. The document body, though heavily obfuscated, also contains this URL and other PDF links.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=api+crusader+vs+summit+viper
    • https://static.usrfiles.com/ugd/b8c837_ba1c95c30cf7409fb381c6f1eafe6daf.pdf
    • https://static.usrfiles.com/ugd/b8c837_cc58c533a3854ec8a080083273e8b5db.pdf
    • https://static.usrfiles.com/ugd/b8c837_d6b7d4e6566648ff8d62b88f85dfd127.pdf
    • https://static.usrfiles.com/ugd/b8c837_2a61fc3bb1214983a4047278be7b03db.pdf
    • https://static.usrfiles.com/ugd/dc8a8e_8d3aad38c0f0420e90d99eca3a9a58fa.pdf
    • https://static.usrfiles.com/ugd/b8c837_5b935660bb4b41b0a56ed5f44f4834f7.pdf
    • https://static.usrfiles.com/ugd/41f880_ceaf7ceaf430460b854bb4e6d84ad12f.pdf
    • https://static.usrfiles.com/ugd/6f58fb_f2429faa247c430e94f219070ba4f256.pdf
    • https://static.usrfiles.com/ugd/599f1c_9ed7f0d6403b4b58bbdd4f3903c9a322.pdf
    • https://static.usrfiles.com/ugd/724fb5_85c7df3f686f40c893d62fa43c71ca84.pdf
    • https://static.usrfiles.com/ugd/b8c837_179fd8786ac64f2db5de0ab89a31cd27.pdf
    • https://static.usrfiles.com/ugd/fb5067_43fd2525aa8748b2b58ca50c83490b44.pdf
    • https://static.usrfiles.com/ugd/20d83a_63c4eb80a2c04457a7d2f05da0e18a88.pdf
    • https://static.usrfiles.com/ugd/b8c837_32111509130144b4908abf939521f081.pdf
    • https://static.usrfiles.com/ugd/2d1648_a130d465e90a444b93b0df72c4da5a90.pdf
    • https://static.usrfiles.com/ugd/9757e7_8862365e31694761ac66dfeaec269b94.pdf
    • https://static.usrfiles.com/ugd/b11f6d_05b7878578d542b7811452e4ccb6dc19.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000061a7.bin
a05d812a36240f05fa6d631c3af8178c4b3b7071401ab67a3a4c9fab97fad3bf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x61A7 5236 bytes
font_01_sfnt_off0000735e.bin
49631c2d14bdc3d7f2e59508b92f73ab011f2fedbd53e2c7ab74d19dec6803e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x735E 10676 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.