Malicious PDF — malware analysis report

Static analysis result for SHA-256 c51d06fb68c34d7a…

MALICIOUS

PDF

51.0 KB Created: 2020-09-12 13:49:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0338994780f5ca08d769fd56eeff30bd SHA-1: 14f1d8dc4bc949bd1fdf22488fba956a461c7b79 SHA-256: c51d06fb68c34d7a13dc08ba497b68e2ce73ee163931b59db5a882a862b88729
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

This PDF document contains a link to a known malicious redirector, ttraff.cc, disguised as a template for organizational change management. The document also features a link farm of 12 external PDF links, many hosted on static.usrfiles.com, which is a common tactic for SEO poisoning to improve search engine rankings for malicious content. The ML classifier strongly indicates maliciousness, and the overall structure suggests a phishing or redirection attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=organization+change+management+plan+template
    • https://static.usrfiles.com/ugd/694d5d_3f30b55924694c17b7a486965dd165ee.pdf
    • https://static.usrfiles.com/ugd/b8c837_f5b4b82739394ef4bb6a35ed2618f455.pdf
    • https://static.usrfiles.com/ugd/7c30af_95a9069c6cec4003b88c0e906832beab.pdf
    • https://static.usrfiles.com/ugd/8de238_8f5bb2bb541544b197fa654cbf4ac286.pdf
    • https://static.usrfiles.com/ugd/e2c223_49adea23c77d4ae0a292ba1780538f6e.pdf
    • https://static.usrfiles.com/ugd/6cabbb_937531055ca84edea7cc47a47e13d01f.pdf
    • https://static.usrfiles.com/ugd/44b221_1946c49f58854071891b239b553103cd.pdf
    • https://static.usrfiles.com/ugd/2ca22b_c5a8d9f1fec8462183ee6ff99b68ff37.pdf
    • https://cdn.shopify.com/s/files/1/0438/2159/6834/files/worshipped_or_worshiped_spelling.pdf
    • https://cdn.shopify.com/s/files/1/0441/3734/9272/files/form_validation_using_angularjs_on_button_click.pdf
    • https://cdn.shopify.com/s/files/1/0429/3256/8220/files/99035979707.pdf
    • https://cdn.shopify.com/s/files/1/0430/5649/6791/files/3270381806.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000089ed.bin
594f6aa2495d39e909be23d2ae8a924cfba5feb72cfdd53cd0e9ae7b494f1ce6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x89ED 5244 bytes
font_01_sfnt_off00009b9f.bin
0f7df226b302eba5c758fc8f174ed8571f3006e86684f23b5fb2e1b9a7bf68b5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9B9F 10428 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.