Malicious PDF — malware analysis report

Static analysis result for SHA-256 1bf241d18893bd58…

MALICIOUS

PDF

58.3 KB Created: 2020-09-02 21:01:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 88cd89dce6c1250b080105325f0762aa SHA-1: cce83356e45f2ed647f4d1859d4dc796f89e25be SHA-256: 1bf241d18893bd58e257a9769da3682369bec02fe6fa2dd000dd0e0ab0ec5a04
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a heuristic firing for a malicious redirector link, which points to 'https://ttraff.link/wix?keyword=antenna+tv+guide+wichita+ks'. The document body, though heavily obfuscated, contains text related to 'Antenna tv guide wichita ks', suggesting a lure to trick users into clicking the malicious link. The file also contains a heuristic for a PDF link farm, indicating a broader campaign to distribute malicious links.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/wix?keyword=antenna+tv+guide+wichita+ks
    • https://static.usrfiles.com/ugd/b8c837_1cf55a1e12b049beaef37598af8b68c3.pdf
    • https://static.usrfiles.com/ugd/67f5f7_c04b7ed8085f4358810a9c7573de0ea4.pdf
    • https://static.usrfiles.com/ugd/b8c837_23cc11c78f5a41a39b4f3c4a94a46175.pdf
    • https://static.usrfiles.com/ugd/b8c837_1ff3186acd834b2e8529789e18225bd5.pdf
    • https://static.usrfiles.com/ugd/a4e402_47f8b5379b1d4c0c92f7b31266460f4d.pdf
    • https://static.usrfiles.com/ugd/d54300_b5ee63e2be914fab9b1f82e7f7041390.pdf
    • https://static.usrfiles.com/ugd/bb13a2_78346b38c5c645dda6fbcce525603288.pdf
    • https://static.usrfiles.com/ugd/04e6f9_b0143152d58a4b408fbdd1d2ace320d1.pdf
    • https://static.usrfiles.com/ugd/824332_6b06b907e435472cb25247388ef5b71d.pdf
    • https://static.usrfiles.com/ugd/b11f6d_addb288e175f4b0baab84bcdf1bdbf90.pdf
    • https://static.usrfiles.com/ugd/1ebe14_323c5515e0c64860ab071ddb96715f4c.pdf
    • https://static.usrfiles.com/ugd/3bca44_d675bbc2361b4630845390eb8d126edc.pdf
    • https://cdn.shopify.com/s/files/1/0431/0899/1125/files/jivorokaxigusulugina.pdf
    • https://cdn.shopify.com/s/files/1/0431/0731/9965/files/92506621640.pdf
    • https://cdn.shopify.com/s/files/1/0435/7193/7439/files/kelisenoj.pdf
    • https://cdn.shopify.com/s/files/1/0431/3910/4930/files/pitivutojilim.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00009a42.bin
2419f23e5919d519b50c79b2c769fe2765eaf1b9b6a2245587917103e803eef4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9A42 5276 bytes
font_01_sfnt_off0000ac51.bin
cbb0a8416100c50751af20de1d38236fd3f9667fa94f723c83038f45fe491e84		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAC51 15052 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.