Malicious PDF — malware analysis report

Static analysis result for SHA-256 a0f6f50bb4bb9152…

MALICIOUS

PDF

36.8 KB Created: 2020-09-02 11:32:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9baf5728275c17e0ce166aab75eff006 SHA-1: 6014f1ced503944fcb2c3a48a2322edbd9b44c88 SHA-256: a0f6f50bb4bb915201c5b9dd8ddc094564e90192060bb692b61858a241454587
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a heuristic firing for a malicious redirector link, pointing to 'https://ttraff.link/wix?keyword=worksheet+for+finite+and+nonfinite+verbs'. The document body, though heavily obfuscated, contains this same URL and also references a 'worksheet for finite and nonfinite verbs', suggesting a lure to disguise the malicious link. The PDF also exhibits characteristics of a link farm, with numerous external links, many pointing to static.usrfiles.com.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/wix?keyword=worksheet+for+finite+and+nonfinite+verbs
    • https://static.usrfiles.com/ugd/628a76_fbcea25da54041c4a73ed064bc07ec0d.pdf
    • https://static.usrfiles.com/ugd/185811_2032172edf464435b5fd2582c2357382.pdf
    • https://static.usrfiles.com/ugd/6e3131_9d31774af78c44f082ddb1613e77fcb9.pdf
    • https://static.usrfiles.com/ugd/b8c837_847600236a9d42ee85982da61d0b7367.pdf
    • https://static.usrfiles.com/ugd/b8c837_bae4ba93a76d481080e3093064abed61.pdf
    • https://static.usrfiles.com/ugd/b8c837_8de2c3f5a3e14d688bca221f8f91ed6d.pdf
    • https://static.usrfiles.com/ugd/e2f7e1_f4587b2e1d414bcb8df9d3fd832c24c2.pdf
    • https://static.usrfiles.com/ugd/83d902_ce9a80e1738548fea8094ac57b26a632.pdf
    • https://cdn.shopify.com/s/files/1/0433/6048/5541/files/18584028634.pdf
    • https://cdn.shopify.com/s/files/1/0435/5971/4971/files/what_s_goofy_s_son_s_name.pdf
    • https://static.usrfiles.com/ugd/99a8f2_700c82b2d2fc4189a963132580256b98.pdf
    • https://static.usrfiles.com/ugd/b8c837_5115728ce64343c68e1683551c93fbcf.pdf
    • https://static.usrfiles.com/ugd/c3f59f_47c68da3570a44d39836fc734329d53a.pdf
    • https://static.usrfiles.com/ugd/35c6e2_8c9d944eab9f4d4ea51f38eec9a817d6.pdf
    • https://static.usrfiles.com/ugd/529ba0_899225e9e43f4a89b25b19fb094ba7ff.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005407.bin
0be502d0209c770d7264413e6443e7aeb6b2226be46961ac3fd80e8f87cdb318		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5407 5240 bytes
font_01_sfnt_off000065e6.bin
eb265966fa277a5fc48375597d9d2732e893178941257c9935c7fbe1063d4607		 pdf-font-stream PDF embedded font (sfnt) at offset 0x65E6 9544 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.