Malicious PDF — malware analysis report

Static analysis result for SHA-256 f87a482e03b08dda…

MALICIOUS

PDF

43.7 KB Created: 2020-09-03 11:12:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1a9f07f20b18644fcaea16ee72cbdb37 SHA-1: e3248ec93a88f3f3365fb893d64494e22be1b284 SHA-256: f87a482e03b08dda003447f722699c7412463da3e5a60c854f539d6ee3b6b3b1
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged as malicious by a machine learning classifier and contains numerous embedded links. One critical heuristic identified a link to a known malicious redirector, and another indicated a large PDF link farm. The document body, though heavily obfuscated, contains the URL https://ttraff.club/wix?keyword=semi+addressable+fire+alarm+system+pdf, which is likely the primary lure. The presence of multiple embedded links suggests an attempt to lead the user to external malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/wix?keyword=semi+addressable+fire+alarm+system+pdf
    • https://static.usrfiles.com/ugd/b8c837_acc9996442cf4f24886946e74f2cdc9d.pdf
    • https://static.usrfiles.com/ugd/64f9d2_acdd8ad541f34f34819bb4b39e1402a8.pdf
    • https://static.usrfiles.com/ugd/338562_be158f2a370a44648292294c3f5c468a.pdf
    • https://static.usrfiles.com/ugd/b8c837_c7d1ec383439454f8aa18a8951e5aa54.pdf
    • https://static.usrfiles.com/ugd/9fc8c3_581dea2e3c624fc4af2add8c4067510a.pdf
    • https://cdn.shopify.com/s/files/1/0434/3057/6278/files/panasonic_aw-_rp120g.pdf
    • https://cdn.shopify.com/s/files/1/0430/9241/0525/files/finaxetaxozuvavanoto.pdf
    • https://cdn.shopify.com/s/files/1/0429/2955/3575/files/wirov.pdf
    • https://static.usrfiles.com/ugd/b8c837_d387e0ed889c4da19f37f4ee07faba37.pdf
    • https://static.usrfiles.com/ugd/edb4a7_610f27339b3c437bbd3da8c96768aec9.pdf
    • https://static.usrfiles.com/ugd/8d0191_be20b867d29a429fb1798f3edbe47b1a.pdf
    • https://static.usrfiles.com/ugd/c63dba_5a5b392e2cd14803a70db02601150c78.pdf
    • https://static.usrfiles.com/ugd/23e9be_4fd8afd337434e8a9dccd18c7b74bb28.pdf
    • https://static.usrfiles.com/ugd/b8c837_4a87aba0e8764feda54d5ba9866ba59c.pdf
    • https://static.usrfiles.com/ugd/9cc572_4688018d60894881a96136948ca51932.pdf
    • https://static.usrfiles.com/ugd/c618e9_c85fa96be5bb44728aa7c7056b0c36b3.pdf
    • https://static.usrfiles.com/ugd/b8c837_3f2fac69a3194e92864e903fbfe23559.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005c2f.bin
fbe025a02cccc543e74ac3b28b2bcd43873e87952cd03fbaafd72e82d4a7a124		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5C2F 5532 bytes
font_01_sfnt_off00006ede.bin
d8e4b7f44dfb66ea49c7f1cefd345a391fade3fb548cc17de4cdbf151663dabd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6EDE 6068 bytes
font_02_sfnt_off00007e8f.bin
dbca79e68c7a07610b63acdf9426f507fdd65829e94b1656c06bb96a4777f4be		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7E8F 10120 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.