Malicious PDF — malware analysis report

Static analysis result for SHA-256 1c3c3297ecfb5760…

MALICIOUS

PDF

37.2 KB Created: 2020-08-29 16:26:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ee64b80f77c3d194dcb67f64baf09c9f SHA-1: b7bd548d3efcc9812f2e5d9e65afd81c8faa7ae4 SHA-256: 1c3c3297ecfb57601b6e782045cc331744757cb54c82603474362f98b1761f3f
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links, many pointing to static.usrfiles.com, which is identified as a link farm. One of the primary links, however, directs to ttraff.com, flagged as a malicious redirector. The document body, though heavily obfuscated, contains the target URL, suggesting a social engineering lure related to programming resources to redirect users to malicious infrastructure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=cracking+the+coding+interview+189+programming+questions+and+solutions+python
    • https://static.usrfiles.com/ugd/b8c837_cd2ae9ae8ce14bfdb84d20c21b217453.pdf
    • https://static.usrfiles.com/ugd/b8c837_dce3492ddc904da6843f81230637b7e9.pdf
    • https://static.usrfiles.com/ugd/b8c837_3430b57eb72440158e15e13c15b71568.pdf
    • https://static.usrfiles.com/ugd/b8c837_c4d409b1e6314d6f9d26c7c135f7d402.pdf
    • https://static.usrfiles.com/ugd/b8c837_de82ef8dd8774e5a86d629f3711181a5.pdf
    • https://static.usrfiles.com/ugd/b8c837_da184cc2007d4a55b383342e8a576f75.pdf
    • https://static.usrfiles.com/ugd/b8c837_3c98805ae44b4a8ab1f946feb251bac6.pdf
    • https://static.usrfiles.com/ugd/b8c837_3fd14edd0c424e399f80c1a2b0f6c6e0.pdf
    • https://static.usrfiles.com/ugd/b8c837_071dbba00ab84b9e86744c2f01ade6c0.pdf
    • https://static.usrfiles.com/ugd/b8c837_c24c944a9cb046c1acfeb53a213222cb.pdf
    • https://cdn.shopify.com/s/files/1/0431/1754/3588/files/66540387888.pdf
    • https://cdn.shopify.com/s/files/1/0466/7985/1173/files/binomial_expansion_worksheet_1_answer_key.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/jakenetukuzalavat.pdf
    • https://cdn.shopify.com/s/files/1/0445/5694/3524/files/guitarist_guide_to_effects_pedals.pdf
    • https://cdn.shopify.com/s/files/1/0440/5982/0182/files/large_file_sample_download.pdf
    • https://cdn.shopify.com/s/files/1/0438/5298/8566/files/2020_audi_q7_mmi_manual.pdf
    • https://cdn.shopify.com/s/files/1/0431/7360/9636/files/82800561395.pdf
    • https://cdn.shopify.com/s/files/1/0433/0812/2270/files/28211266059.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004c4d.bin
4d3bd8a841d3afb4f5c050530e8edbe0e2551d72e3b4e47f469c6015de2b45f0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4C4D 6236 bytes
font_01_sfnt_off00006170.bin
4cd16b800b42d68005aac7ad101d18a613a969ae85882dad2d825c36f7a3163f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6170 10328 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.