Malicious PDF — malware analysis report

Static analysis result for SHA-256 f110ce4517c712bf…

MALICIOUS

PDF

53.6 KB Created: 2020-08-31 03:41:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a765fa53da63069eb25313d7b731ec36 SHA-1: 600b9eefba2dc213c491157b27bd0c95c9e71fc8 SHA-256: f110ce4517c712bfa5db2a06260425583c2bdadfce297b61278bddb842167e7d
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged as malicious by an ML classifier and contains a critical heuristic indicating it's a redirector link to a known malicious infrastructure. Additionally, it exhibits characteristics of an SEO link farm, embedding a large number of external PDF links, with one prominent example being static.usrfiles.com. The document body, though heavily obfuscated, contains a URL that matches the redirector link found in the heuristics.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=ponte+en+onda+scooby+doo+capitulo+1
    • https://static.usrfiles.com/ugd/b3bc21_b2e14369b650464a9b3f7c95e90f45c9.pdf
    • https://static.usrfiles.com/ugd/b8c837_dd612951ca1747b4a411d83b7988187c.pdf
    • https://static.usrfiles.com/ugd/90c678_c92dde325cab4c9a8107859aa9f4a9f2.pdf
    • https://static.usrfiles.com/ugd/227d0f_f8cd63d0bc294eaf9ca3ff6ffdac0993.pdf
    • https://static.usrfiles.com/ugd/f96b02_705b85ffda8741b99d30a2c27a48ac30.pdf
    • https://static.usrfiles.com/ugd/b8c837_ecca9774b4e14120a00f63ae7b267244.pdf
    • https://static.usrfiles.com/ugd/fac845_bb800490a262402295f17929f4bf6a5e.pdf
    • https://static.usrfiles.com/ugd/067ecb_42424b3b7ac24e178cd057ce1e6bcc26.pdf
    • https://static.usrfiles.com/ugd/2b3f46_cfa687cf592b41d281ef48eabed6aa5e.pdf
    • https://static.usrfiles.com/ugd/d9d1f5_000e4f53bb8844b5941547430d21d0bf.pdf
    • https://static.usrfiles.com/ugd/23e9be_6b5d391a5a2c4dee87af5190124f0a46.pdf
    • https://static.usrfiles.com/ugd/b8c837_fbdc8e6b6902448cb83e89134be9ba4f.pdf
    • https://static.usrfiles.com/ugd/b8c837_58c7b4841bae4ed893488f877f87e318.pdf
    • https://static.usrfiles.com/ugd/b8c837_9789c00d347f4b03877ef1bc5c59f908.pdf
    • https://static.usrfiles.com/ugd/b8c837_f4b4e6ad63e74aae84127cfbd282512b.pdf
    • https://static.usrfiles.com/ugd/b8c837_32d0e5eec7444aec95b8c0c306ace257.pdf
    • https://static.usrfiles.com/ugd/b8c837_9fb24b56143f48fe9235d6d03ba7d6b2.pdf
    • https://static.usrfiles.com/ugd/bb13a2_1a349ff9a4c64a46888ec1580a50ec60.pdf
    • https://static.usrfiles.com/ugd/b8c837_c5432a837e1640449b5d90d6a5e1ebe3.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00009330.bin
53fcc59aab3d0d03565472111e2a07e8c78a5b95a556a3f2019886a22544b9f2
pdf-font-stream PDF embedded font (sfnt) at offset 0x9330 5264 bytes
font_01_sfnt_off0000a52c.bin
ebcab33e41c297865643e87790a49bfcb2e71de8b3c8364da3df4009808347e2
pdf-font-stream PDF embedded font (sfnt) at offset 0xA52C 10676 bytes