Malicious PDF — malware analysis report

Static analysis result for SHA-256 8557a115af3dbc83…

MALICIOUS

PDF

38.9 KB Created: 2020-09-13 11:48:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 00ea8d8d762682aeb22a7a7a75edbf82 SHA-1: b5acdf4c70c5332be20214f5dc157d0e780d41fa SHA-256: 8557a115af3dbc8378101cbc25a80b545787ac950c9db1dcdf587a0f1f3531f7
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.ru/wix?keyword=from+point+a+to+point+b'. Additionally, it exhibits characteristics of a PDF link farm, with numerous embedded links to external PDFs, including 'https://static.usrfiles.com/ugd/b8c837_f54f9318435f4cac88e1bd6d3ad48bfb.pdf'. The ML classifier also strongly flagged this PDF as malicious. The document body, though heavily obfuscated, contains references to these URLs, suggesting a lure to external malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=from+point+a+to+point+b
    • https://static.usrfiles.com/ugd/b8c837_f54f9318435f4cac88e1bd6d3ad48bfb.pdf
    • https://static.usrfiles.com/ugd/dd6616_b1d7beaf18ca4d28a6d2c14d3531d049.pdf
    • https://static.usrfiles.com/ugd/9219f8_ff3b2358e64448adb4db42932e6a4560.pdf
    • https://static.usrfiles.com/ugd/ced2dc_43e5056eaf154d3089e108acc7b98ffa.pdf
    • https://static.usrfiles.com/ugd/aaaf79_0a724df0b81344b994608789ece2e404.pdf
    • https://static.usrfiles.com/ugd/87a178_a939ce53db7e4a83b1409df2c80cbcf4.pdf
    • https://static.usrfiles.com/ugd/086daf_6f0269cfe4d14f8d8b18306412e6ff22.pdf
    • https://static.usrfiles.com/ugd/50988c_db447c75834e4b40bbe7311a1185b67d.pdf
    • https://static.usrfiles.com/ugd/25c42e_f4e6e922a22c47ec9f6dabb4d272bc98.pdf
    • https://static.usrfiles.com/ugd/e42ee3_cda2c9113a5345409a908ea3ccc09c0c.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005c8e.bin
78776c315e03618078182e7a66302411570e57502dbea1afe9925a98f086db9a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5C8E 4848 bytes
font_01_sfnt_off00006cf0.bin
a999404475df856c55b26904292bf5154052044b0ba6827d9a9d7112cbd1d2b3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6CF0 10016 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.