Malicious PDF — malware analysis report

Static analysis result for SHA-256 513b2b8abdc26d95…

MALICIOUS

PDF

47.4 KB Created: 2020-08-30 23:32:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 11af739b10553c298ff159ef110e0926 SHA-1: 3827492fa5078e25f35fb549f27084b42b05b0c1 SHA-256: 513b2b8abdc26d950f652718339f196b286c5f974dd8ff7db7c693f892956db5
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a link to a known malicious redirector, ttraff.cc, which is designed to lead users to further malicious content. The document body, though heavily obfuscated, contains the URL and a title that suggests a lure. The ML classifier strongly flagged this PDF as malicious, and the presence of numerous external links, many pointing to static.usrfiles.com, indicates a link farm designed for SEO poisoning or redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=levantada+de+cruz+pdf
    • https://static.usrfiles.com/ugd/b8c837_bc39da9b86d745b483d639da26f044d9.pdf
    • https://static.usrfiles.com/ugd/b8c837_adf2ac53552b41a4b979e46e9bfcefbb.pdf
    • https://static.usrfiles.com/ugd/353d00_63de1171a57441aba90d300cf2026186.pdf
    • https://static.usrfiles.com/ugd/97368a_c5682d7cec534974ac3f617a26dab290.pdf
    • https://static.usrfiles.com/ugd/0d9a50_d9bd076ec07c47b6900228ac0cd8b9ea.pdf
    • https://static.usrfiles.com/ugd/b8c837_e96821df49074073aed284cbbc37b7f2.pdf
    • https://static.usrfiles.com/ugd/c6ac46_2e7b69979139496ea4151e5ea4b99135.pdf
    • https://static.usrfiles.com/ugd/dd4472_5473ed4746c14ae5a9da700ec58926e6.pdf
    • https://static.usrfiles.com/ugd/6c032c_628d0aaaf81c4198bc5b49cad37e2f94.pdf
    • https://static.usrfiles.com/ugd/b8c837_3d2309370a324b2c9b9d451de9dedad4.pdf
    • https://static.usrfiles.com/ugd/b8c837_bb414885479d47a6a728a34559383fb7.pdf
    • https://static.usrfiles.com/ugd/b8c837_db5ce2301eab471998b6d72e6d83ad04.pdf
    • https://static.usrfiles.com/ugd/b8c837_c3432394b27c49f6849e96a7c898cee8.pdf
    • https://static.usrfiles.com/ugd/9b5f63_4b5d5aeb71ce4c2eac5f00aa1dfcda49.pdf
    • https://static.usrfiles.com/ugd/3e87bf_cfca265b6fdc4827849e293ba73b06fd.pdf
    • https://static.usrfiles.com/ugd/b8c837_1cd81dc27d2d4ab3a7601226f188ad43.pdf
    • https://static.usrfiles.com/ugd/b8c837_b03a392f0c864f339b26f3c3b6d0a86f.pdf
    • https://static.usrfiles.com/ugd/9374a7_6d4826a716dc477487f36c8a788b0f15.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000078f3.bin
d71f0c6f3b98e3fe70813f9b97a0c68b071b8e15fc070f1fd72dce38e20bf0a0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x78F3 4992 bytes
font_01_sfnt_off00008a13.bin
0a048fbf03df2e1f4eaf89453b7f6595fd3c1a1018c8a80ea75bda64625b78b1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8A13 11596 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.