Malicious PDF — malware analysis report

Static analysis result for SHA-256 49777b94b090042b…

MALICIOUS

PDF

55.4 KB Created: 2020-08-30 00:46:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9aa381fb4514c7cadfe5ffa07e97e01b SHA-1: 071b6c5eec3a0aa174d1cfffd0b065a63d6c3ede SHA-256: 49777b94b090042bd74e4933c87617e8ab90080d6c3f2df6d08a09bb93ee7ebf
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a link to a known malicious redirector, ttraff.com, which is disguised as an employee settlement letter. This indicates a phishing attempt to lure users to a malicious site. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=employee+full+and+final+settlement+letter+format
    • https://cdn.shopify.com/s/files/1/0433/8424/2337/files/james_bond_violin_sheet_music.pdf
    • https://cdn.shopify.com/s/files/1/0437/8011/2535/files/86798289457.pdf
    • https://cdn.shopify.com/s/files/1/0433/1274/2555/files/14944708693.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/26450106566.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/83260340608.pdf
    • https://cdn.shopify.com/s/files/1/0435/3294/3519/files/android_oneplus_emulator.pdf
    • https://cdn.shopify.com/s/files/1/0431/1928/0288/files/mafex.pdf
    • https://cdn.shopify.com/s/files/1/0434/1599/4529/files/61801953825.pdf
    • https://cdn.shopify.com/s/files/1/0432/5870/8136/files/21361319737.pdf
    • https://cdn.shopify.com/s/files/1/0431/8999/3621/files/55192492029.pdf
    • https://static.usrfiles.com/ugd/f65518_38b75cbcc9014dddbc44667af5c0767d.pdf
    • https://static.usrfiles.com/ugd/b8c837_c051c2ad37c547e49deeae9af09b1a8c.pdf
    • https://static.usrfiles.com/ugd/b8c837_0e1df0d4c01a47d7a501a097d1c4e0b3.pdf
    • https://static.usrfiles.com/ugd/b8c837_79498a9681a742d5ad474c77ba802910.pdf
    • https://cdn.shopify.com/s/files/1/0459/3241/3095/files/uwell_caliburn_manual.pdf
    • https://cdn.shopify.com/s/files/1/0430/0485/4426/files/sanizad.pdf
    • https://cdn.shopify.com/s/files/1/0428/6975/1967/files/anarchism_or_socialism.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008fde.bin
85b692c1c636aed9ab1240d2a7361179fdd6c0849396a06064984f922e967b4f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8FDE 2828 bytes
font_01_sfnt_off000099d8.bin
ecb3d28cd414ef4f77af53503b5c460f1234db1ca0833c4fb8888a0501439555		 pdf-font-stream PDF embedded font (sfnt) at offset 0x99D8 5244 bytes
font_02_sfnt_off0000aba2.bin
ffaaf2c9faed85a2129ab434474e861b7f73d2f144b1eb381ec938d6e1931cc2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xABA2 10364 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.