Malicious PDF — malware analysis report

Static analysis result for SHA-256 7c38ded959527ec9…

MALICIOUS

PDF

54.1 KB Created: 2020-09-02 02:29:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 02e96784bfbb2ab6457634dd689fb9e9 SHA-1: 6e638200ec528c25907aef55e89608836b934be6 SHA-256: 7c38ded959527ec910bc7bffdee92507f5a9980578c2a7f069b9680b92e485be
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains numerous embedded links, with a critical heuristic firing for PDF_MALICIOUS_REDIRECTOR_LINK, pointing to 'https://ttraff.com/pify?keyword=attention+letter+template'. This URL is likely used to redirect the user to malicious content. The document body, though heavily obfuscated, contains text fragments suggesting it is an 'attention letter template', which is a common lure for phishing attacks. The presence of a large number of external links also triggered the PDF_SEO_LINK_FARM heuristic.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=attention+letter+template
    • https://static.usrfiles.com/ugd/b8c837_a6210fa0add848b795733c8bad17d172.pdf
    • https://static.usrfiles.com/ugd/97634b_c1e830ee7c7040fa8772b43b17ebaacd.pdf
    • https://static.usrfiles.com/ugd/73cb9e_f024ccb6758b4ade8520acdb38945906.pdf
    • https://static.usrfiles.com/ugd/b8c837_acdbb6ff422f4e5e854f4982dd587dd7.pdf
    • https://cdn.shopify.com/s/files/1/0431/2147/5738/files/basic_english_grammar_book_1.pdf
    • https://cdn.shopify.com/s/files/1/0437/2873/2314/files/zavaxudukerunoboko.pdf
    • https://cdn.shopify.com/s/files/1/0433/9325/3526/files/spirit_level_app_free.pdf
    • https://cdn.shopify.com/s/files/1/0440/2066/2422/files/50146858754.pdf
    • https://cdn.shopify.com/s/files/1/0434/1992/6679/files/sociological_school_of_law.pdf
    • https://cdn.shopify.com/s/files/1/0465/3550/8126/files/inquiries_on_credit_report_how_long_stay.pdf
    • https://static.usrfiles.com/ugd/ac51ce_742ca2b01a7f4f67a0f6258f4c5779cd.pdf
    • https://static.usrfiles.com/ugd/1df9ea_a87e7fa0e1c845e5b49064178eeb5937.pdf
    • https://static.usrfiles.com/ugd/67f5f7_17eb5d0ab7cb4f148e592dffa509643f.pdf
    • https://static.usrfiles.com/ugd/6d59ab_7567290de8754a92903b325e59ed86a6.pdf
    • https://static.usrfiles.com/ugd/b8c837_5a9305f6588b4474adc7c5e9845fe4ff.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000095bf.bin
b644d7bd995463f5d14903a7e774eb0069b43858f5dbd74c7a6501b2fe17be9b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x95BF 4776 bytes
font_01_sfnt_off0000a5df.bin
c66896fda292e5b3bfa814a23822a201657497720a2dbb6c9e8817a6eed688e9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA5DF 10976 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.