Malicious PDF — malware analysis report

Static analysis result for SHA-256 5a24e9266c8443a3…

MALICIOUS

PDF

46.0 KB Created: 2020-09-08 16:54:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 01fb6836dd3abe3c379c6244a3675111 SHA-1: 43165c2dfd6066b4a0a189353ff71bb4b32c7ac1 SHA-256: 5a24e9266c8443a3fbf902aa54d9df2b41d5703295f619dfbd076855a6abdd82
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a malicious redirector link that points to 'ttraff.link', a known malicious domain. The document body, though partially corrupted, includes text related to 'best photo editing app for android offline' and the malicious URL, suggesting a lure. The PDF also exhibits characteristics of a link farm, with numerous external links, many pointing to 'static.usrfiles.com'. The ML classifier strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/wix?keyword=best+photo+editing+app+for+android+offline
    • https://static.usrfiles.com/ugd/0d002d_20ccadc4b2434987b805a4474db0c84a.pdf
    • https://static.usrfiles.com/ugd/a91264_e97b3b2f80d24755970479f6783c23dc.pdf
    • https://static.usrfiles.com/ugd/9f6a24_0717e6d979664b0ca6b6a3ab0b0a47a9.pdf
    • https://static.usrfiles.com/ugd/b8c837_e4f7ac90e6dd4d6b9195487a5d661922.pdf
    • https://cdn.shopify.com/s/files/1/0435/6902/1089/files/hungarian_rhapsody_no_6_piano_sheet.pdf
    • https://cdn.shopify.com/s/files/1/0432/6670/3516/files/2015_usda_dietary_guidelines_cholesterol.pdf
    • https://cdn.shopify.com/s/files/1/0440/8714/8709/files/padasuxazipok.pdf
    • https://static.usrfiles.com/ugd/b8c837_f60e6bf37bba49bab33a35556f3a8162.pdf
    • https://static.usrfiles.com/ugd/ab922d_2038fb78f3bd40d2932af303849d40e0.pdf
    • https://static.usrfiles.com/ugd/1a89c8_8859b4b601ca4976a12ad18641277aa2.pdf
    • https://static.usrfiles.com/ugd/b8c837_96f1f79f01ab40d9b0803742480f2cd7.pdf
    • https://static.usrfiles.com/ugd/b8c837_ae16763e77354fbca7f2a30d6e3d5dbe.pdf
    • https://static.usrfiles.com/ugd/f241d9_6149cb87a65c4a5296284dd8789d0780.pdf
    • https://static.usrfiles.com/ugd/136d07_7ae3c8e2c0c34dea83634bafc20c64f0.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007584.bin
5f93d130df7b1d63c44265e72d748278fa978ddf3d9ca4772d11323c5dfcbe2e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7584 5352 bytes
font_01_sfnt_off000087ba.bin
f9cbce55bfc91217edcd4f0f951a37e7536f6371d0c7b95c70b7f07bafd19d51		 pdf-font-stream PDF embedded font (sfnt) at offset 0x87BA 10352 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.