Malicious PDF — malware analysis report

Static analysis result for SHA-256 b7798d3db85591e6…

MALICIOUS

PDF

41.4 KB Created: 2020-08-31 23:44:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2fe4ab180c8d16a41db8a37f1cc8a7ef SHA-1: 7a6befa838a3778c101bbab837cdf27a5a0c3370 SHA-256: b7798d3db85591e614f3747e92bc8bf109b280186f820b69972f6ce12a04d5be
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a heuristic firing for a malicious redirector link pointing to 'ttraff.com'. The document body, though heavily obfuscated, contains text related to 'insect guide australia' and the malicious URL, suggesting a lure. The PDF also exhibits characteristics of a link farm, with numerous embedded URLs pointing to 'static.usrfiles.com', likely for SEO manipulation to increase visibility of the malicious redirector.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=insect+guide+australia
    • https://static.usrfiles.com/ugd/3cb679_a58055bcfce44526826bc741cf784c69.pdf
    • https://static.usrfiles.com/ugd/b8c837_935f39ae9fc64dfdafd45904ef9bd08c.pdf
    • https://static.usrfiles.com/ugd/02beb7_03799040f6d249878e6806227405582d.pdf
    • https://static.usrfiles.com/ugd/a2c2bc_e24cc1733ede40abbffb461c01606978.pdf
    • https://static.usrfiles.com/ugd/b8c837_d8437edf42124d90af2ed2b0b7ae2280.pdf
    • https://static.usrfiles.com/ugd/2ac701_6aad7c6b16754df39661ca8f21af97d3.pdf
    • https://static.usrfiles.com/ugd/b8c837_54b9d9deb186495c844334894d34d319.pdf
    • https://static.usrfiles.com/ugd/b4f0c6_cfdf6df53ed441a49a5dfb7e6401f34d.pdf
    • https://static.usrfiles.com/ugd/837d34_4c7b72554978432da73ca7080cd09d56.pdf
    • https://static.usrfiles.com/ugd/b8c837_9757a9fd410f454e90d91bf7c36e36fc.pdf
    • https://static.usrfiles.com/ugd/b8c837_6c2424dbfb4942b5888198bdc3fc4aff.pdf
    • https://static.usrfiles.com/ugd/b8c837_3fbd43e5beb14735a9fcf11d3ae562a0.pdf
    • https://static.usrfiles.com/ugd/158fb9_bfec35fb40444aef9b0ed51f69bf9444.pdf
    • https://static.usrfiles.com/ugd/6203b9_dba67ee1ac274597b923160d24cb59a3.pdf
    • https://static.usrfiles.com/ugd/6da380_2b74ee4cc39047efb42533100fb9fe00.pdf
    • https://static.usrfiles.com/ugd/b8c837_5ad51b6408ef4ed9af97f2a90451d3d1.pdf
    • https://static.usrfiles.com/ugd/fd3290_0590cd931f944521aecabbe6673aae40.pdf
    • https://static.usrfiles.com/ugd/b8c837_ce0eb75b390749449b9ce8ebc3cee67d.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000647a.bin
e7f8cf0b2fdfcf2719a63fa0b6c0e6ec9f4433c8a935dd7b8814566649e5c1ff		 pdf-font-stream PDF embedded font (sfnt) at offset 0x647A 5044 bytes
font_01_sfnt_off000075ae.bin
b73a69db8c4cbbdf6190ff19130d26dcc5da4c2a20b4f6bdda6cc71af0ca4085		 pdf-font-stream PDF embedded font (sfnt) at offset 0x75AE 10248 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.