Malicious PDF — malware analysis report

Static analysis result for SHA-256 fd74af9466603081…

MALICIOUS

PDF

31.5 KB Created: 2020-09-06 10:03:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2bef6524e868ef85f10c7a62515b7f1a SHA-1: 82bc6b5b81c6508301007a57ee259f89fd99c4d6 SHA-256: fd74af94666030814ed4cadf1cdc81624c0d4f3bcad5446aae61dbc995cc8308
174 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 User Execution: Malicious Link

The PDF file is identified as a malicious redirector, employing an image-only lure to entice users to click on a link. The primary link, 'https://ttraff.cc/pify?keyword=red+background+hd+images+free', leads to known malicious infrastructure. The document also contains a large number of embedded links, many pointing to static.usrfiles.com, which is part of a link farm strategy. The ML classifier strongly supports the malicious verdict.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 31 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=red+background+hd+images+free
    • https://static.usrfiles.com/ugd/724bd4_2b4e3fdaaa724f15b3c15f9e88cf5900.pdf
    • https://static.usrfiles.com/ugd/b4a829_6ba4a22f549d43ed9832c6a0e5c1a85e.pdf
    • https://static.usrfiles.com/ugd/271e65_666a8e6c0e094b71a4ea3d0e17401a18.pdf
    • https://static.usrfiles.com/ugd/6da380_90d37d3d44ef4428807d47d2ec5870fa.pdf
    • https://static.usrfiles.com/ugd/f80014_3e75cb5046314efe853d1f089135b714.pdf
    • https://cdn.shopify.com/s/files/1/0427/8039/3639/files/vilep.pdf
    • https://cdn.shopify.com/s/files/1/0431/3756/4823/files/best_free_bootstrap_4_admin_template_2018.pdf
    • https://cdn.shopify.com/s/files/1/0451/3038/3514/files/mivawevevoxefogesitovo.pdf
    • https://static.usrfiles.com/ugd/b3bc21_a1ef10c835a94842824c9673fa4b1afb.pdf
    • https://static.usrfiles.com/ugd/eb6612_b71fa6246b5d47ea84870128e02501d5.pdf
    • https://static.usrfiles.com/ugd/9734e7_1244e685d9eb444fb4084da4c916d7e6.pdf
    • https://static.usrfiles.com/ugd/0c41e7_90722f03438a4b00b025b461f09642e1.pdf
    • https://static.usrfiles.com/ugd/10a4aa_dd477be8c3f54b019462a6403f96241a.pdf
    • https://static.usrfiles.com/ugd/865d50_b4e75fbdc61e47f38fbe6bb3f1ddbf52.pdf
    • https://static.usrfiles.com/ugd/b8c837_b23ce2d2f3c54206a6c606cf8ab8cece.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000042b2.bin
33f512e899487241764d4379a22337157d0e24de11ee7a5ec48c5f893d4aac7e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x42B2 5612 bytes
font_01_sfnt_off000055a4.bin
1cda83d76412604a5ce76838458746ed32d5340d2ac8f4e3ad681b7adce68e48		 pdf-font-stream PDF embedded font (sfnt) at offset 0x55A4 8180 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.