Malicious PDF — malware analysis report

Static analysis result for SHA-256 4e06e9025792eba2…

MALICIOUS

PDF

45.9 KB Created: 2020-08-31 11:28:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 07f2d596bf0e6c5c135a4e8575499b11 SHA-1: 47aa358e80ed87805d08a2f0b707dd0eccd92b0f SHA-256: 4e06e9025792eba21231e6be29d8b316b1a757fc7a66981209c98da3a62962c4
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a significant number of embedded links, with many pointing to static.usrfiles.com, suggesting a link farm or SEO manipulation tactic. One critical heuristic identified a link to a known malicious redirector, ttraff.cc, which is likely the primary malicious component. The ML classifier strongly indicated maliciousness. No scripts were extracted, and the document body was heavily obfuscated.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=raccord+air+comprim%25C3%25A9+staubli
    • https://static.usrfiles.com/ugd/b8c837_beda2112739f4224a552c0d643a189dc.pdf
    • https://static.usrfiles.com/ugd/299074_3fae6e6ba1244d3ca4422d75fa8b671c.pdf
    • https://static.usrfiles.com/ugd/5cf23b_c018481b762648cb872ea34384608705.pdf
    • https://static.usrfiles.com/ugd/b8c837_3a9e319c0919441899b43172727d5cb5.pdf
    • https://static.usrfiles.com/ugd/bb13a2_aab690ce152647eb9a55d1c76193bbb9.pdf
    • https://cdn.shopify.com/s/files/1/0433/6487/6453/files/xoveziwajawobizamorajogog.pdf
    • https://cdn.shopify.com/s/files/1/0457/8974/1222/files/21445250665.pdf
    • https://cdn.shopify.com/s/files/1/0430/1871/5289/files/jebidujukafaf.pdf
    • https://cdn.shopify.com/s/files/1/0432/7315/8806/files/44474654515.pdf
    • https://static.usrfiles.com/ugd/69b86f_bcd4ad9816a04a5f8b39df425bc675f1.pdf
    • https://static.usrfiles.com/ugd/ba3095_6502b0485fb347ab8f7581f8c4d29182.pdf
    • https://static.usrfiles.com/ugd/6c98bc_7c939d10ed354151a65df0c1e411fcf8.pdf
    • https://static.usrfiles.com/ugd/105a8c_c42641439c2a462590f6b887122558ea.pdf
    • https://static.usrfiles.com/ugd/822ecd_6f974c696de442a79e80171df450d3cb.pdf
    • https://static.usrfiles.com/ugd/f63f29_46e9943e863f4ad6955408f802a8fe9b.pdf
    • https://static.usrfiles.com/ugd/b8c837_a74ee7a4a4634f53bebacecd2b2037c6.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000543a.bin
93c8d5d6c81a83738e9e9cd0836b3942f67b85f68668218c563c91b18fdbe143		 pdf-font-stream PDF embedded font (sfnt) at offset 0x543A 4628 bytes
font_01_sfnt_off000064a9.bin
7d828525b236c8db54f0073b1dc6bedf66b03ddf7f567c0af98942b6061cbd79		 pdf-font-stream PDF embedded font (sfnt) at offset 0x64A9 5164 bytes
font_02_sfnt_off00007633.bin
e632868a9d5f341bddcbf0b8fa14a74924a49c8a7fdb2a059f2940bb15eea1fd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7633 11420 bytes
font_03_sfnt_off00009a54.bin
ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9A54 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.