Malicious PDF — malware analysis report

Static analysis result for SHA-256 3c96aa3fdb0f83c0…

MALICIOUS

PDF

44.0 KB Created: 2020-09-07 06:31:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 00989917b99f2e1a9eb99a9bd7158903 SHA-1: 966bec55357b44117ae374222ec271786e1d37ad SHA-256: 3c96aa3fdb0f83c0b4cb3e076701f5dd8f3c1f0d100bdd1bbd395a3ef3ed9207
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'https://ttraff.ru/wix?keyword=6th+grade+ela+test+prep+worksheets'. Additionally, the PDF exhibits characteristics of a link farm, with numerous embedded links to external PDFs, many hosted on 'static.usrfiles.com'. The document body, though heavily obfuscated, contains references to educational content and the malicious URL, suggesting a lure to disguise malicious activity. No scripts were extracted, but the PDF structure and URL firings strongly indicate a phishing or redirection attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=6th+grade+ela+test+prep+worksheets
    • https://static.usrfiles.com/ugd/08e331_b4b322c6753c46fa956456302665d359.pdf
    • https://static.usrfiles.com/ugd/8b9728_ed4a76873f5a4d3f8adcb1a41d624ce6.pdf
    • https://static.usrfiles.com/ugd/b8c837_d221bb340ad944d69e184493d3fe66db.pdf
    • https://static.usrfiles.com/ugd/5e81b9_d6b156c6155147f8a7debf8ce6945818.pdf
    • https://static.usrfiles.com/ugd/b8c837_43597533810547daa7ba4c2ad732d0a5.pdf
    • https://static.usrfiles.com/ugd/5be868_724618d420284ce4a836a8b8bd1d8971.pdf
    • https://static.usrfiles.com/ugd/895bef_f8e067fdbe874c99ab664a027d5d8050.pdf
    • https://static.usrfiles.com/ugd/b8c837_ceab100c7ad044f2b9bdfc36ff82f750.pdf
    • https://static.usrfiles.com/ugd/60933b_46f4f04de6a242cdbf3d692e4622ca26.pdf
    • https://static.usrfiles.com/ugd/eb4c03_ed522009212547df99c22e458e57dd5e.pdf
    • https://static.usrfiles.com/ugd/5360f8_dddfef0e87834479a7e15d0a5165e6ab.pdf
    • https://static.usrfiles.com/ugd/625844_f308c5ace9b54896a31f5baa85bc12ff.pdf
    • https://static.usrfiles.com/ugd/b8c837_d762bab8e367463a80d8b9eff268446d.pdf
    • https://static.usrfiles.com/ugd/f8de3e_2b4e00113df7489a983de3eecb4c7df7.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006e5e.bin
47cea3025ddf42dd250471b3b89f6c16e93554fa2dae45aca782f150b589f58d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6E5E 5436 bytes
font_01_sfnt_off000080e7.bin
51627492ea6414944c253898cb68c45378bd15e4177c36055818ed514297df1e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x80E7 10060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.