Malicious PDF — malware analysis report

Static analysis result for SHA-256 feef76eb1283b6a6…

MALICIOUS

PDF

48.5 KB Created: 2020-08-29 20:42:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fb9f467262f2573165daf6640f7aa976 SHA-1: 615e57229a089e7a3fae738255f2e6708c4c421f SHA-256: feef76eb1283b6a6af077079cf8f1f47c260aeeeaab200a498e8f6e5e8627a8f
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a critical heuristic firing indicating a malicious redirector link. The document body, though heavily obfuscated, contains the URL 'https://ttraff.ru/wix?keyword=tactics+for+toeic+listening+and+reading+test+pack', which is flagged as a malicious redirector. Additionally, the PDF includes a large number of links to external PDFs, many hosted on 'static.usrfiles.com', suggesting a link farm or SEO poisoning tactic to lure victims. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=tactics+for+toeic+listening+and+reading+test+pack
    • https://static.usrfiles.com/ugd/6290de_d1abfb608b0f43a7bc5148c7da8ff5c8.pdf
    • https://static.usrfiles.com/ugd/1be480_826150365e544a8c9206c91196aaf007.pdf
    • https://static.usrfiles.com/ugd/b8c837_96b525a2971e46f187e573606558a986.pdf
    • https://static.usrfiles.com/ugd/b8c837_ea840c07449841309ba662df1533cf19.pdf
    • https://static.usrfiles.com/ugd/b8c837_a0412d6663414fa8aff2bbdb051e9225.pdf
    • https://static.usrfiles.com/ugd/b8c837_707dd770c9d44046818d941c272db7f4.pdf
    • https://static.usrfiles.com/ugd/c3548c_92c55e99a34b48989b992b187ce57050.pdf
    • https://static.usrfiles.com/ugd/b8c837_beaf0f4ae0944100b8047c300d0beb16.pdf
    • https://static.usrfiles.com/ugd/b8c837_d771a117df0c467e8870d4fd291b8aa6.pdf
    • https://static.usrfiles.com/ugd/b8c837_97bb5a741a0e419a82bba4f1c117ca3a.pdf
    • https://static.usrfiles.com/ugd/b8c837_f2b9532331dc4e2fb6faa92178c372c5.pdf
    • https://static.usrfiles.com/ugd/b8c837_0d92b88587ee450aaaa20a7ded358862.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005268.bin
ae7cadc8bf06426d57f89bf717060fa5a8f7fa5387fde230cdbb4bfd8cb8eb20		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5268 3584 bytes
font_01_sfnt_off00005f28.bin
ffd81e3b2926835123aa79b3862b2dd78a487d6d40d0412cd90e08e15699418a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5F28 5336 bytes
font_02_sfnt_off0000714b.bin
079522c7af19b2f073b867046aa8ed43a50b1e1629f7f8091175b0708d745ee0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x714B 9892 bytes
font_03_sfnt_off00008d88.bin
c091152f17325347698e97c59db2b3b75083f42eb7ee99fc675c9cba01f7003e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8D88 11076 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.