Malicious PDF — malware analysis report

Static analysis result for SHA-256 e082acdfbcd469cb…

MALICIOUS

PDF

42.4 KB Created: 2020-08-31 18:22:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 221ed9aa80bb99e2bf2c9909f3925151 SHA-1: cbc156aa8049116239ce8f500af249a8ac144871 SHA-256: e082acdfbcd469cb36163224586cf0581512ccd5e5d6d738c1392e21f0907601
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a link to a known malicious redirector, ttraff.com, which is disguised as an educational worksheet. This indicates a phishing or social engineering attempt to redirect the user to malicious infrastructure. The PDF also contains a large number of external links, many pointing to static.usrfiles.com, suggesting a link farm or SEO poisoning tactic to improve search engine ranking for malicious content. The ML classifier strongly supports the malicious verdict.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=exponential+rate+of+change+worksheet
    • https://static.usrfiles.com/ugd/7e6083_59b7d51a37664721a749e08319768a9d.pdf
    • https://static.usrfiles.com/ugd/2ca09c_b5edd04e1346438fbce453f6aae087ae.pdf
    • https://static.usrfiles.com/ugd/105a8c_75c0f4c487444f1fbb9f8e1c7c71f820.pdf
    • https://static.usrfiles.com/ugd/ca300b_475fff88d457466cb4079de84d573259.pdf
    • https://static.usrfiles.com/ugd/b8c837_7a45e558f3324f9fa88b2b70a111708f.pdf
    • https://cdn.shopify.com/s/files/1/0435/0767/9397/files/36581880583.pdf
    • https://cdn.shopify.com/s/files/1/0430/9146/0247/files/30391253316.pdf
    • https://cdn.shopify.com/s/files/1/0428/2204/1767/files/88666316097.pdf
    • https://cdn.shopify.com/s/files/1/0433/0536/9758/files/dictionary_of_advaita_vedanta.pdf
    • https://cdn.shopify.com/s/files/1/0429/9826/8065/files/building_construction_by_rangwala_free.pdf
    • https://cdn.shopify.com/s/files/1/0428/3206/8775/files/vuvononavugegepatavipeni.pdf
    • https://cdn.shopify.com/s/files/1/0431/5525/9546/files/download_al_quran_digital.pdf
    • https://static.usrfiles.com/ugd/4bb894_0d9fce83744846c5a382e257efb35945.pdf
    • https://static.usrfiles.com/ugd/b8c837_c8fc5307b7c84764b06b437b970d8ec4.pdf
    • https://static.usrfiles.com/ugd/a2d007_4844f6a93a7148fa9aac4ae051d4497d.pdf
    • https://static.usrfiles.com/ugd/314c35_fd13d84d693e49e5af14e81028748cee.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000669b.bin
c660706b353bf001f23593f0f6a3f198e8ebe13b60651f8e095eb4d0c6604850		 pdf-font-stream PDF embedded font (sfnt) at offset 0x669B 5460 bytes
font_01_sfnt_off00007944.bin
d9561e8ef772f6f0ac681477d9d0e4e4272d9181b828437c6758976fe2d52032		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7944 10364 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.