Malicious PDF — malware analysis report

Static analysis result for SHA-256 caaff2bc064cf614…

MALICIOUS

PDF

67.3 KB Created: 2020-08-30 19:39:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9e054f3bdf2544c7b4cfd5cb28df0a46 SHA-1: aa3a171c465d8d3d851f2545dbdd45e5a3c36f21 SHA-256: caaff2bc064cf614031a97c06c0c2f95bc98f71cc682b7370167a4567b2f4610
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a link to a known malicious redirector, ttraff.cc, which is designed to lure users to malicious content. The document body, though heavily obfuscated, contains the URL and text related to 'doctrinas de la gracia', suggesting a social engineering pretext. The PDF also contains a large number of external links, many pointing to static.usrfiles.com, which is flagged as a link farm.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=doctrinas+de+la+gracia
    • https://static.usrfiles.com/ugd/89c6ad_8c5efb61beb54b57b1f4e85a4cd62e5a.pdf
    • https://static.usrfiles.com/ugd/b8c837_17acb46139ee4491971b2177195a64c9.pdf
    • https://static.usrfiles.com/ugd/b8c837_60c9c85ca29d449d84a253961dab7a14.pdf
    • https://static.usrfiles.com/ugd/b8c837_c92885005f1e4e63921941a4326e60d0.pdf
    • https://static.usrfiles.com/ugd/a2e20a_d1bf42a050914541bb14e21426ad887b.pdf
    • https://static.usrfiles.com/ugd/b8c837_adbeaf83cda6478c97d63ead09e9c5b8.pdf
    • https://static.usrfiles.com/ugd/80bfa9_5267fcffa4a240359549b387b4ad61d7.pdf
    • https://static.usrfiles.com/ugd/b8c837_e21d9c5114c74ac4886e1bad2ef47d17.pdf
    • https://static.usrfiles.com/ugd/738632_775769babaf74c67bccc5e3b294a9258.pdf
    • https://static.usrfiles.com/ugd/7ea8bb_806700cd50c94c8ab699d0fcadce002e.pdf
    • https://static.usrfiles.com/ugd/b8c837_88b9ef4220b64299b85ebb8981df6e3a.pdf
    • https://static.usrfiles.com/ugd/b8c837_df1eccf167f74f62aa404de7dda292d6.pdf
    • https://static.usrfiles.com/ugd/ca300b_fdffc59651504d4fa1293e91ca2ae5f0.pdf
    • https://static.usrfiles.com/ugd/33a16d_f3f76986dfd04a22abdd6ffa95f92de2.pdf
    • https://static.usrfiles.com/ugd/b8c837_d7ad1b28489c4ecb8a9d12318e518c9b.pdf
    • https://static.usrfiles.com/ugd/c7a620_e23457ff6e2f4a00925204ab2e6eadf0.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c7cc.bin
f166090b9d36e945ce053d396c6bfcd5f7df3b48969c48c1571c9d9fd9882c68		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC7CC 5104 bytes
font_01_sfnt_off0000d92e.bin
7139650a6cf7c47e74abb8014ac79cfe3ed9f8d405ea811aa5e3ce22efe01f7a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD92E 11512 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.