PDF malware analysis — malicious · ebcd59afd65f3117

MALICIOUS

PDF

55.8 KB Created: 2020-09-02 06:13:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: d6cad0418852f07c9c14b83ce5531cef SHA-1: 2cd65c83ad2f5d095a11d240dd5a94f17f64021f SHA-256: ebcd59afd65f3117569a038094734f9b935ce87566c2282bd23ec2a8370435d0

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

This PDF file contains a heuristic firing for a malicious redirector link, pointing to 'https://ttraff.me/wix?keyword=desolation+wilderness+fishing+report'. The document body, though heavily obfuscated, also contains this URL, suggesting it's the primary lure. The file also includes a large number of links to static.usrfiles.com, which is flagged as a link farm. The ML classifier strongly indicates maliciousness.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.me/wix?keyword=desolation+wilderness+fishing+report
- https://static.usrfiles.com/ugd/275374_8b887db91f434722a02ed7413ebf1ea9.pdf
- https://static.usrfiles.com/ugd/ef7b09_b56b75a7db81410d89df6d2add29064e.pdf
- https://static.usrfiles.com/ugd/26938b_2dd69fa87fe947f3b0940169f8f339b2.pdf
- https://static.usrfiles.com/ugd/b8c837_d08cb33ae5f14941bfc7375b4b153197.pdf
- https://static.usrfiles.com/ugd/aec2ea_9478a56416974bb3b9dcea128dc77288.pdf
- https://static.usrfiles.com/ugd/4b68be_6042814d134d44079543a41962c559b2.pdf
- https://static.usrfiles.com/ugd/55f640_8cfe45a662a9436fbeca33fe6b1ae9b0.pdf
- https://static.usrfiles.com/ugd/b9801a_9b3f4a838cc141e7a575b62a8ee6126f.pdf
- https://static.usrfiles.com/ugd/72b0e7_62bb2e11e99944d78b0cfe3259240d72.pdf
- https://static.usrfiles.com/ugd/6f53d7_fe5402a6fd0e43f981f4efbeacb880a1.pdf
- https://cdn.shopify.com/s/files/1/0435/6292/6229/files/fatofej.pdf
- https://cdn.shopify.com/s/files/1/0446/5026/6787/files/letter_of_appreciation_for_scholarship.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00009bb1.bin` `e814427986838515e3b27ad911a33ad26f513baf7a041edab464b7eb77f58781`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9BB1	5396 bytes
`font_01_sfnt_off0000ae1e.bin` `b75b984bd78bb927eb7b49c4a1859aa40f007096234d926aa0ce4f15f29f3169`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xAE1E	10536 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.