Malicious PDF — malware analysis report

Static analysis result for SHA-256 c144c03b5b34a90c…

MALICIOUS

PDF

69.1 KB Created: 2020-08-31 03:33:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ed84887100b20f16b908e96f68b4d5fc SHA-1: 3f53b897a02ba47a99f6313426ccbd2bf8b73252 SHA-256: c144c03b5b34a90ccddad0ec293dc83a83124e8b3a9f8e724faad686303ba7ef
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a critical heuristic firing for a malicious redirector link pointing to ttraff.ru. Additionally, it exhibits characteristics of a PDF link farm, embedding numerous links to external PDF files hosted on static.usrfiles.com. The ML classifier also strongly indicated maliciousness. These factors suggest the document's primary purpose is to lure users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=%25D9%2582%25D9%258A%25D8%25A7%25D8%25B3+%25D8%25B3%25D8%25B9%25D8%25B1+%25D8%25A7%25D9%2584%25D8%25B4%25D8%25B1%25D9%258A%25D8%25B7+100+%25D9%2585%25D8%25AA%25D8%25B1
    • https://static.usrfiles.com/ugd/f09a9d_432f5851f62f4200ae59672e03cd5c4f.pdf
    • https://static.usrfiles.com/ugd/834936_f8a0f86ef68e4cab9e38d03b71fafc40.pdf
    • https://static.usrfiles.com/ugd/a1fb72_230cb8a3a0d1485f9e74357952f3a571.pdf
    • https://static.usrfiles.com/ugd/b8c837_ad930f9d705b458d8c3e80af9d8e9ac8.pdf
    • https://static.usrfiles.com/ugd/69695d_53df80ff48234fbca0876a9d7aa35336.pdf
    • https://static.usrfiles.com/ugd/b8c837_023fcff311f84dc89e92900234c5be53.pdf
    • https://static.usrfiles.com/ugd/95089d_e5997f0c7b5141dfa1fd481485002901.pdf
    • https://static.usrfiles.com/ugd/857e61_1b78441c68764a93b032c769f2d7eee4.pdf
    • https://static.usrfiles.com/ugd/b8c837_032545bc579f4844a2adcab88841ae67.pdf
    • https://static.usrfiles.com/ugd/ab059d_87f4d76b8b6c4777b6a0498083c39577.pdf
    • https://static.usrfiles.com/ugd/ef7b09_da246c5821ec4036bd298992bd10a986.pdf
    • https://cdn.shopify.com/s/files/1/0429/3296/1443/files/41769162109.pdf
    • https://cdn.shopify.com/s/files/1/0437/7329/6789/files/21263864946.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_006_off0000cdf8.bin
5d2a7120c9338322f76299f7607a18864d8ac7582f79a47402683ed3bdd2bb18		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xCDF8 31436 bytes
font_00_sfnt_off000087cc.bin
102c4579b85e15a5b3258b4b89dcd182e0c3479eb2ad3480e5cc7e745e46f9d1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x87CC 4260 bytes
font_01_sfnt_off0000965a.bin
578cc403637aa4d11c121047f731ae30339edc5d000459b6f1e9da8b9f460216		 pdf-font-stream PDF embedded font (sfnt) at offset 0x965A 17768 bytes
font_02_sfnt_off0000b0a0.bin
ecb45b3b90b66665e3dcac74f349dc62b75cbd45a5328aa072a7acc7a10fe5ef		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB0A0 8584 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.