Malicious PDF — malware analysis report

Static analysis result for SHA-256 55c3b938074eec94…

MALICIOUS

PDF

40.8 KB Created: 2020-09-02 00:17:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a014cd6166693af5fdb98dcd1b872593 SHA-1: eb6d6e78cb9aed63328d01ca8fd55a9631ae8798 SHA-256: 55c3b938074eec945a0b82e4aca8cf6303876e9242308c669a83f3b026fc3fca
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a link farm and a primary malicious redirector URL, suggesting a phishing or social engineering lure. The document body, though garbled, contains keywords related to IRS and audit techniques, reinforcing the lure. The primary malicious URL is https://ttraff.cc/wix?keyword=irs+conservation+easement+audit+techniques+guide, which is likely used to redirect the user to a malicious site. The numerous benign URLs likely serve to camouflage the malicious one.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=irs+conservation+easement+audit+techniques+guide
    • https://static.usrfiles.com/ugd/4c3d6a_6af724ea66f14165a5e71c830787f0b5.pdf
    • https://static.usrfiles.com/ugd/5cd33b_5adeab998989468dbe589ce5ffb16cd0.pdf
    • https://static.usrfiles.com/ugd/3f0e57_b51f8128783a44a4870511fc83f7dc74.pdf
    • https://static.usrfiles.com/ugd/24853a_c7771a9271f947d48576d77e61e3c6d2.pdf
    • https://static.usrfiles.com/ugd/5cd33b_6d1bdd82dc7b43c2859829087e2ab660.pdf
    • https://static.usrfiles.com/ugd/0dcf4b_15bef1edef4746daa5f6b517658b9531.pdf
    • https://static.usrfiles.com/ugd/36d413_0ddec8f1c1334772bcd63a84d0c5f428.pdf
    • https://static.usrfiles.com/ugd/b8c837_39b5926b6d2743f98b7495f268de3080.pdf
    • https://cdn.shopify.com/s/files/1/0428/9105/1161/files/46314718411.pdf
    • https://cdn.shopify.com/s/files/1/0463/0288/8093/files/82483281611.pdf
    • https://cdn.shopify.com/s/files/1/0430/8559/4775/files/muwig.pdf
    • https://cdn.shopify.com/s/files/1/0429/5193/4108/files/adding_and_subtracting_fractions_worksheet_with_answers.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000061a9.bin
cfbd93207eb25147e5ece59d1028ce6d6f1d0a60e46a205f631b1d79b844b61f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x61A9 5444 bytes
font_01_sfnt_off00007401.bin
6915d0702b0253444d23571a0cc86263544a0c240b566d4ed479349686af914e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7401 10052 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.