Malicious PDF — malware analysis report

Static analysis result for SHA-256 a65fc795f6eb2a9a…

MALICIOUS

PDF

55.8 KB Created: 2020-08-31 01:22:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ad30af3fdcd3956987c9bffe0fcfb030 SHA-1: 95fc2df9da9f73c2a487640db375da3df5aeeda0 SHA-256: a65fc795f6eb2a9ae0bc3fb5f5cb90a75c103eb2b8e6a5d24e7420fbe307f5bc
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.me/wix?keyword=7+articles+of+the+constitution+works'. This URL is likely used to redirect the user to a malicious site for phishing or malware delivery. The PDF also contains a link farm heuristic, indicating a large number of external links, many of which are benign but serve to obscure the malicious one. The ML classifier strongly supports the malicious verdict.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=7+articles+of+the+constitution+works
    • https://static.usrfiles.com/ugd/b8c837_43597533810547daa7ba4c2ad732d0a5.pdf
    • https://static.usrfiles.com/ugd/4b68be_11116fcc467f41f399ad7c8987de15ca.pdf
    • https://static.usrfiles.com/ugd/b8c837_8f3cfe0583d54cd0b63d2ef6556a1ace.pdf
    • https://static.usrfiles.com/ugd/5b9a87_b900621344a149d583b969cd61c1117f.pdf
    • https://static.usrfiles.com/ugd/37428b_00d410b61834474eb56c5971dfc0c7d3.pdf
    • https://static.usrfiles.com/ugd/0c268c_6b6ccf4162974364a8d224bb994702c6.pdf
    • https://static.usrfiles.com/ugd/d43733_9da81d761ae64dad8c19acecd0152579.pdf
    • https://cdn.shopify.com/s/files/1/0435/0168/2843/files/139_bus_schedule_nj_transit.pdf
    • https://cdn.shopify.com/s/files/1/0437/1569/0650/files/chagas_tratamento.pdf
    • https://cdn.shopify.com/s/files/1/0464/1174/3400/files/adhe_kangal_songs_masstamilan.pdf
    • https://cdn.shopify.com/s/files/1/0430/4066/9849/files/zisavejamagixigewis.pdf
    • https://cdn.shopify.com/s/files/1/0433/7899/9446/files/88172650730.pdf
    • https://static.usrfiles.com/ugd/18f527_2b54860753d4402f94d757af94666fcc.pdf
    • https://static.usrfiles.com/ugd/e5a943_f448d702321d4587a24bbfb923151c47.pdf
    • https://static.usrfiles.com/ugd/b8c837_f30c5b81840947059d01847d45cdc094.pdf
    • https://static.usrfiles.com/ugd/b8c837_bdacf10884604719b5fe5f97e6c3203c.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_006_off0000a270.bin
c7cf8dde701d7b90ed8eabdc11e0a6181170fa77e759f07465b9ffce2386f733		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xA270 18340 bytes
font_00_sfnt_off00006ee4.bin
91d05f7c3c5429ec36b289fba27e3d8ec362f1a72cc0375472aba62536499a4b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6EE4 5108 bytes
font_01_sfnt_off0000804a.bin
ddb254ee2887e0b670444a49e1b96a6cdec3d3fbd8307baf2363968250afae09		 pdf-font-stream PDF embedded font (sfnt) at offset 0x804A 9900 bytes
font_03_sfnt_off0000bf8e.bin
ed73177915dbddf442303508da7069a0403846cb3c07eb0f17f3d997d208caa1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xBF8E 5092 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.