Malicious PDF — malware analysis report

Static analysis result for SHA-256 3f5dee3345288205…

MALICIOUS

PDF

51.6 KB Created: 2020-08-31 11:16:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: dfc6db28876458f61fe09eae50a14154 SHA-1: aa8ac387ae15763aa0b8da4ef7d4ce41b9d7d631 SHA-256: 3f5dee3345288205b070ec63862bffcc728656b090284222e4a56fd283cd30b1
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a critical heuristic firing for a malicious redirector link, directing users to 'ttraff.cc'. The document body, though heavily obfuscated, contains this same URL, suggesting it's the primary lure. The presence of numerous other PDF links, many pointing to 'static.usrfiles.com', indicates a link farm strategy, likely to obscure the malicious destination. The ML classifier strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=hot+chip+i+feel+better
    • https://static.usrfiles.com/ugd/b8c837_4cf83f491a9749a1b00babc78116eb85.pdf
    • https://static.usrfiles.com/ugd/2f8cea_7bc29f0261bc498d983c57157644d15f.pdf
    • https://static.usrfiles.com/ugd/37321e_a4361f7b04724842884125d2af2e6e74.pdf
    • https://static.usrfiles.com/ugd/edb4a7_b006dfca9de646c188017ee6f46218b4.pdf
    • https://cdn.shopify.com/s/files/1/0429/1392/3228/files/business_analysis_case_study_examples.pdf
    • https://static.usrfiles.com/ugd/253000_33e4ce1661a2474d8539b6a56c854fd4.pdf
    • https://static.usrfiles.com/ugd/b8c837_0ef679854fea45288d56e30c085e44bb.pdf
    • https://static.usrfiles.com/ugd/e3834b_72e3a36d0e6146d2bae57bef2fa0d0fb.pdf
    • https://static.usrfiles.com/ugd/69695d_58261a262a6b4de082f55da5163d5225.pdf
    • https://static.usrfiles.com/ugd/b8c837_63aad2c1a8234b43a7d25d63c193b7e7.pdf
    • https://static.usrfiles.com/ugd/29c71c_dc0681ca76374af8968485b3056ee313.pdf
    • https://static.usrfiles.com/ugd/33a16d_9c47412791e94822af2cf8707b9df663.pdf
    • https://static.usrfiles.com/ugd/23b571_282e764db5c2481ca2c5140a039c60b8.pdf
    • https://static.usrfiles.com/ugd/b8c837_23f56fb7c5aa4f549d25ecc446686185.pdf
    • https://static.usrfiles.com/ugd/a31856_ad74ec4dad8a450b92d1f6b0e31e0e44.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000581f.bin
7927aad23909a2a7c7ed42ca9a56b5b25580a47d8b5496cb033053502220925b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x581F 17024 bytes
font_01_sfnt_off00008e00.bin
70b917494beba41657a335e37beb3aa7be44e7371875db7cfcd9b07a476712a7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8E00 4816 bytes
font_02_sfnt_off00009e50.bin
9a4e8d9233d80450afe0c3874307828c711e501786ba38edd50a805e6c8e932b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9E50 9720 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.