Malicious PDF — malware analysis report

Static analysis result for SHA-256 950d56e140a651fe…

MALICIOUS

PDF

34.7 KB Created: 2020-09-18 02:37:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0307cd9b25b37732d91441ca6fd53c71 SHA-1: 27a81930f3f27f4e72f0c0c8e87c1341c8ab2604 SHA-256: 950d56e140a651fee07965b8bcd8f4ee736494cc4a31025d3cfc67942bb9165d
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF contains a large number of embedded links, including a critical link to a known malicious redirector at https://ttraff.cc/wix?keyword=math+1+eoc+practice+test. The document body, though heavily obfuscated, contains references to practice tests and URLs, suggesting a lure. The ML classifier also strongly indicated maliciousness. The primary attack pattern involves redirecting the user to malicious infrastructure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=math+1+eoc+practice+test
    • http://files.mval.org/uploads/1/3/0/7/130775633/xinovebikujag.pdf
    • http://files.bluestonegrill.net/uploads/1/3/1/4/131413550/varubelapuwixek.pdf
    • https://f609f129-1f39-44ab-a7f2-7772707c1bf3.filesusr.com/ugd/cb2bed_838867670a13435bbdb205cafcc3a4a9.pdf?index=true
    • https://d02b4782-e490-4565-a95a-5fdc2521a992.filesusr.com/ugd/5e8de6_4bc468dba7b646cebb7f69a6e2e7e806.pdf?index=true
    • https://dcf20d3a-b698-4e31-839d-fb428777e5e3.filesusr.com/ugd/d61b30_e96a31ee95dd4df09190e7cd9ca99a11.pdf?index=true
    • https://b4a02cec-6acf-49ad-89c4-ac1870d663aa.filesusr.com/ugd/61b8bf_e06bfd7c262c469fa4ec921c26982c61.pdf?index=true
    • https://213b0303-5565-4742-9902-4a3013d66b4d.filesusr.com/ugd/5f5755_eb7a9acffcef471cbb02d025ad62698e.pdf?index=true
    • https://637aeb66-d847-471b-9423-8d9d2c8e5634.filesusr.com/ugd/1e52da_d9c189bb5b1942ba9de80298f3f5b60e.pdf?index=true
    • https://842ba585-1654-42d0-9886-0247f0324b0b.filesusr.com/ugd/cc089a_8afed1cfc87844a0abdd5242e70c7230.pdf?index=true
    • https://65c2f098-b7f5-41ca-9525-029cda67975c.filesusr.com/ugd/a58b01_805bbf6bfa174dea9859ae44d822559a.pdf?index=true
    • https://73e66511-3033-452d-ab2e-8d70c9b0eaa1.filesusr.com/ugd/e948c1_96319e4a18cb44c89b4b3f9de0fc0bcb.pdf?index=true
    • https://fab4c9c3-4fe9-461c-b1af-209baef12e2d.filesusr.com/ugd/68ec51_88c3c06b3a03485fbdf89cffe3a09501.pdf?index=true
    • https://d60fb413-f777-4c43-bc43-9095951b4491.filesusr.com/ugd/d48fe3_e893689eb90a457293a45f58153ea153.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004bea.bin
d04ad98ae855751cfcc8ad6ac5b7ef862c4575be376ebae8756c2b7fbedcdcc9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4BEA 5044 bytes
font_01_sfnt_off00005d1c.bin
bf5421b41b2fb605ead4641d6de1bf49b6f48f8e65ba8c229ebf2fd5a39e4823		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5D1C 9780 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.