Malicious PDF — malware analysis report

Static analysis result for SHA-256 fdde8f0b71444510…

MALICIOUS

PDF

57.8 KB Created: 2020-08-30 17:51:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a145f810e51076d03fa9add72387ea52 SHA-1: 6df7eff7e0e46b3b97a4ad44b447fe610ccd1b83 SHA-256: fdde8f0b71444510109668e5880ac8fd446113d245e8b206dd4205bf7b057130
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a heuristic firing for a malicious redirector link pointing to 'ttraff.com', which is used in SEO link farm schemes. The document body, though heavily obfuscated, contains the same URL, suggesting it's a lure for users searching for movie content. The PDF is structured as a link farm, with numerous links to 'static.usrfiles.com', likely to improve search engine ranking for the malicious lure. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=the+angry+birds+movie+2+full+movie+in+english
    • https://static.usrfiles.com/ugd/724bd4_9b695894b15b47c28cfe0f4ad76d0b52.pdf
    • https://static.usrfiles.com/ugd/b8c837_57ff512707e844248063155b12a8eefa.pdf
    • https://static.usrfiles.com/ugd/0dcf4b_06b9ef25dee34248940338312a29685e.pdf
    • https://static.usrfiles.com/ugd/b8c837_623b77815142466584cc69fe5b4dead3.pdf
    • https://static.usrfiles.com/ugd/b8c837_30bda6cbade347fe9b4b4577d96426f8.pdf
    • https://static.usrfiles.com/ugd/b8c837_30a319ecbfb8443d8351d97a3c243ee1.pdf
    • https://static.usrfiles.com/ugd/b8c837_740894a2559842da8337605579bd9dab.pdf
    • https://static.usrfiles.com/ugd/26481d_664074adc2d34da68429c581f309b3a2.pdf
    • https://static.usrfiles.com/ugd/277b62_4912cdb61c044b68be6beeccc0d70409.pdf
    • https://static.usrfiles.com/ugd/2b3f46_7a01d28309c2421fbeb9cb18c59d5530.pdf
    • https://static.usrfiles.com/ugd/1849a1_78bae1e3988e429cbd9a30e574eba4d1.pdf
    • https://static.usrfiles.com/ugd/286fb8_0cd54b3cd2d24d61b760ac4f61e0114a.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000072e5.bin
69c526daf17e7d5443fb84070c800e1702c536a9164537924292c3d0087e1dbc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x72E5 5704 bytes
font_01_sfnt_off0000862f.bin
a0074de20083a2b476d435465e8975f903d308be4a377bbcbad24f732803600f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x862F 12176 bytes
font_02_sfnt_off0000ad29.bin
fdaa3a60fb851773cb446f6f2b3263308380a32686d3425ec58af4f0525c2bb2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAD29 17780 bytes
font_03_sfnt_off0000c852.bin
db1b8345a8ef711d7a840ed486660c50eec6d6055b42a80abb427052acbe8bdd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC852 4504 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.