Malicious PDF — malware analysis report

Static analysis result for SHA-256 f8349f7beea75ad7…

MALICIOUS

PDF

38.5 KB Created: 2020-08-30 14:32:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2f0966cc63113bcc08bcd49269177e55 SHA-1: 6f2a03112a36d08a525034b4418c2ac15e9dc843 SHA-256: f8349f7beea75ad75de351ae16bfbf2f8892faabab8da1df2fc2d142d74ae8e1
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by multiple critical heuristics for containing a malicious redirector link and a large PDF link farm. The embedded URL https://ttraff.ru/wix?keyword=about+teacup+pomeranian is identified as a malicious redirector. The document body, though heavily obfuscated, also contains this URL and numerous other links pointing to static.usrfiles.com, suggesting a coordinated effort to distribute traffic to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=about+teacup+pomeranian
    • https://static.usrfiles.com/ugd/b8c837_5b86ac5d3a4c43088823d502d87f9643.pdf
    • https://static.usrfiles.com/ugd/b8c837_771c7bb782ae4ffabacd897664d6389f.pdf
    • https://static.usrfiles.com/ugd/a86d68_c62d33fe05e745f3b5d13eccb7f64c32.pdf
    • https://static.usrfiles.com/ugd/921909_3e5daa7d0a9944358783a8841e447003.pdf
    • https://static.usrfiles.com/ugd/79cb75_1eae6ed273af4196a87e4976c8c8e1a0.pdf
    • https://static.usrfiles.com/ugd/23e9be_0dd922099d1b4d039e390e52b3e44eb2.pdf
    • https://static.usrfiles.com/ugd/c6ac46_654d8dbc5c20436d8c181bfc9c33eb33.pdf
    • https://static.usrfiles.com/ugd/7c30af_e52330d6c8dd43b68ff6e100817d9252.pdf
    • https://static.usrfiles.com/ugd/a107db_d9f19b7b0bdf44768592a6b589a3ae8f.pdf
    • https://static.usrfiles.com/ugd/b8c837_263d4133e17c4f9e95aaa360348159d3.pdf
    • https://static.usrfiles.com/ugd/ddb60a_7a72003829ee4732a48a153297fc984e.pdf
    • https://static.usrfiles.com/ugd/238140_da379feafb2d45fe88896bca960af7e9.pdf
    • https://cdn.shopify.com/s/files/1/0427/6885/9303/files/consumer_reports_laptop_buying_guide_2018.pdf
    • https://cdn.shopify.com/s/files/1/0436/2482/4995/files/60703542870.pdf
    • https://cdn.shopify.com/s/files/1/0435/1649/3976/files/saxubokovosukozisem.pdf
    • https://cdn.shopify.com/s/files/1/0428/1883/0503/files/63121918989.pdf
    • https://cdn.shopify.com/s/files/1/0428/0002/1667/files/33030524770.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005978.bin
87d4ec6a0fdf73b1178238948de2e29a741e471fdf455068f7c757dc66b6a936		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5978 5000 bytes
font_01_sfnt_off00006a5c.bin
c54cb5df40bf110a864b2b8bfd923b7da5be458a1acd85b5af6cd7b993adedb0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6A5C 10292 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.