Malicious PDF — malware analysis report

Static analysis result for SHA-256 23698c5759e83b27…

MALICIOUS

PDF

35.8 KB Created: 2020-09-01 17:18:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 006d729d47aafe7b3931baef4c2e53b1 SHA-1: 684e119f5138006f0b7e8db9c75977964f059689 SHA-256: 23698c5759e83b27af52fcae95fdfff2e53d4400edc5e2244378f9fe76e57961
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'https://ttraff.me/wix?keyword=lewis+capaldi+songs+free'. This URL is presented within the document body, disguised as a free download for popular music, indicating a social engineering lure. The PDF also contains a large number of embedded links, many of which point to static.usrfiles.com, suggesting a link farm designed to obscure the malicious destination. The ML classifier strongly supports the malicious nature of this PDF.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=lewis+capaldi+songs+free
    • https://static.usrfiles.com/ugd/b8c837_ac8ba9cb165b40049bd01e7c91be5b7c.pdf
    • https://static.usrfiles.com/ugd/e2f7e1_3f70ff333682499894e14c376204e81a.pdf
    • https://static.usrfiles.com/ugd/b8c837_02fcd7a8c76540ff8357d32089e30245.pdf
    • https://static.usrfiles.com/ugd/b8c837_4599b1e1f34d4d9885625c493d52c647.pdf
    • https://static.usrfiles.com/ugd/d1d005_643c487b9a2146b39407e13340ab630d.pdf
    • https://static.usrfiles.com/ugd/df4650_4d8de9eec4b54eac9054e77d436cf0e1.pdf
    • https://static.usrfiles.com/ugd/60933b_4571d906664f49c2b13d7196c66de4ef.pdf
    • https://static.usrfiles.com/ugd/0e9fc2_436e2b443e2041cd9c16c35a5a52abef.pdf
    • https://static.usrfiles.com/ugd/b8c837_2d89d6439cac4a22ace7d31827e05513.pdf
    • https://static.usrfiles.com/ugd/3ce946_06f94170d2254795accf75278e90582d.pdf
    • https://static.usrfiles.com/ugd/b8c837_a973b37b504147cd9253f887e3dad7d3.pdf
    • https://static.usrfiles.com/ugd/9edd50_ade62cd7c1204e2bb8eea0c46d63ea75.pdf
    • https://static.usrfiles.com/ugd/47b1e8_201c8af0fc6b4b188105a785cb32500a.pdf
    • https://static.usrfiles.com/ugd/b8c837_dbef19994c02481a98afd43b7786c9c2.pdf
    • https://static.usrfiles.com/ugd/b88e3d_140ed65099db4ccfa87df2327ad4d02f.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/61047377128.pdf
    • https://cdn.shopify.com/s/files/1/0435/2363/7399/files/44625848843.pdf
    • https://cdn.shopify.com/s/files/1/0428/1060/5735/files/65235588577.pdf
    • https://cdn.shopify.com/s/files/1/0440/6181/9045/files/wofofatobutefikefa.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004d2b.bin
35f14df505ddd0b30606d0d0990c9d5234d9b86e5d6618466cc56c80b8c0b849
pdf-font-stream PDF embedded font (sfnt) at offset 0x4D2B 5356 bytes
font_01_sfnt_off00005f8b.bin
99d532dc35acc46a6aa80270a820280b696a86a81d5762255d2a69136f4c6e73
pdf-font-stream PDF embedded font (sfnt) at offset 0x5F8B 10292 bytes