Malicious PDF — malware analysis report

Static analysis result for SHA-256 cc6b65e1ed46fcb8…

MALICIOUS

PDF

40.5 KB Created: 2020-08-31 06:08:24 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b7ddcb0f079c703b6ce82cb40aacefaf SHA-1: 92eee7a62fbf19b26306f55c3c539664713c4fe5 SHA-256: cc6b65e1ed46fcb83de13f3f7666e461ed3f12c31c0c5e1519e01c5e3f07d903
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a link to a known malicious redirector, ttraff.cc, which is likely intended to lead the user to a malicious site. The document body, though heavily obfuscated, contains text that appears to be a document title and the malicious URL. The presence of a large number of external PDF links, many pointing to static.usrfiles.com, suggests a link farm or SEO poisoning attempt to increase the visibility of the malicious redirector.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=quimica+sanguinea+45+elementos+que+detecta
    • https://static.usrfiles.com/ugd/b8c837_29cc4f099a0f4d629efbc9cdbdbc87e2.pdf
    • https://static.usrfiles.com/ugd/b8c837_9021e0a4d19a420d9e7f540be05bb835.pdf
    • https://static.usrfiles.com/ugd/fedf23_892b96388687427db999381da2152fe7.pdf
    • https://static.usrfiles.com/ugd/3e5d97_ce845800845d4e7383bcbcdbd65671ec.pdf
    • https://static.usrfiles.com/ugd/b8c837_b9f0b932ee554fec96eb601382c7aa5c.pdf
    • https://cdn.shopify.com/s/files/1/0463/2890/5889/files/85309231440.pdf
    • https://cdn.shopify.com/s/files/1/0440/8049/6792/files/proyecto_de_grado.pdf
    • https://cdn.shopify.com/s/files/1/0431/7446/1594/files/aws_kubernetes_tutorial.pdf
    • https://cdn.shopify.com/s/files/1/0462/4180/8535/files/stranded_deep_how_to_heal.pdf
    • https://static.usrfiles.com/ugd/f103bb_14745eb7e43b4fdc83dee0f807c895d3.pdf
    • https://static.usrfiles.com/ugd/362633_a725f60046884080b65227f9b1909ebe.pdf
    • https://static.usrfiles.com/ugd/913720_6cdb1ad7df5e45698b07ade448ac16a9.pdf
    • https://static.usrfiles.com/ugd/b8c837_432cfe9ff0eb48fca92d68034e3bf6a2.pdf
    • https://static.usrfiles.com/ugd/9e53d4_ca34a166eec6484d863fd66e7e5749b4.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005e20.bin
346b4748de0bd44b0a43e5da1714ec5c86331aa08134cb16aed051a3db2ef11b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5E20 5564 bytes
font_01_sfnt_off000070fe.bin
0481bdef857266e83b9483958ff829c5f47643ae5479f5b1976259f5e49d6fab		 pdf-font-stream PDF embedded font (sfnt) at offset 0x70FE 10520 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.