Malicious PDF — malware analysis report

Static analysis result for SHA-256 1e1ecb5c386809b9…

MALICIOUS

PDF

37.8 KB Created: 2020-08-31 02:19:19 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3f9ee00bac6e4acb735b4b8ad8cdce00 SHA-1: 9bb45b3b13bc000b78e6b104a69d949803af202e SHA-256: 1e1ecb5c386809b97417604fe0d20d31416d4e75f8d512ae05463190a87b1d91
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a critical heuristic firing for a malicious redirector link pointing to 'https://ttraff.ru/wix?keyword=soul+calibur+6+season+pass+content'. This URL is likely used for phishing or to redirect to further malicious content. The document also exhibits characteristics of a PDF SEO link farm, with numerous embedded links to external PDFs, suggesting an attempt to manipulate search engine results or distribute content. No scripts were extracted from this sample.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=soul+calibur+6+season+pass+content
    • https://static.usrfiles.com/ugd/b8c837_74d288e799504b99958d9226f29c1549.pdf
    • https://static.usrfiles.com/ugd/764aaa_3d1894e7666b42f981da420edc6c79bb.pdf
    • https://static.usrfiles.com/ugd/33a2e4_b549439205454e40a2fcd59c20440925.pdf
    • https://static.usrfiles.com/ugd/b8c837_feea9c8c46c14084a1ed97d141a35646.pdf
    • https://static.usrfiles.com/ugd/b8c837_c5c3eec5cda04c8e9819206fed996b30.pdf
    • https://static.usrfiles.com/ugd/b3bc21_9843998819124bf0bd7eefab356454a3.pdf
    • https://static.usrfiles.com/ugd/7e0eb0_a423a6a1b21a4f9187979289cb488d55.pdf
    • https://static.usrfiles.com/ugd/b8c837_741b7f6a61d14d2093375e09dc85b30b.pdf
    • https://static.usrfiles.com/ugd/b8c837_764dcd0bbcdf41518aff5b515259969a.pdf
    • https://static.usrfiles.com/ugd/b8c837_d87cadde1a834953bef59706939dbe68.pdf
    • https://static.usrfiles.com/ugd/73c254_03688344d5fd40b1920f6c79597f52c4.pdf
    • https://static.usrfiles.com/ugd/d775a9_119b2db3ea31455b942c5848e6c5413a.pdf
    • https://static.usrfiles.com/ugd/b8c837_62820aa7407f4a74aae379d055a23c7b.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000538e.bin
8ab87529a378bd9a59179b7a26b7f9db64a006a2725f9d0fc8d8a390d6b54ed5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x538E 5324 bytes
font_01_sfnt_off000065a3.bin
bd913aceba21a9c8cafefe35b9522a88655f56cdc6c7adbc333c575f0d223071		 pdf-font-stream PDF embedded font (sfnt) at offset 0x65A3 11096 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.