Malicious PDF — malware analysis report

Static analysis result for SHA-256 1fd33977e26d65b1…

MALICIOUS

PDF

40.1 KB Created: 2020-08-31 04:03:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 52a1517a9f038f732aed744b7f6388a8 SHA-1: 5d00890de9ad31fb3b24e978d00ec5d136aaaede SHA-256: 1fd33977e26d65b1c1b19d59966abc7e671e535675220f3f2f4d9c5dfaf1492c
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a link to a known malicious redirector, ttraff.cc, which is likely used to deliver a secondary payload. The document body, though heavily obfuscated, contains the same URL and references a topic ('Rocket league latency variation') to entice clicks. The presence of numerous external PDF links also suggests a link farm technique to improve search engine ranking and distribute malicious content.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=rocket+league+latency+variation
    • https://static.usrfiles.com/ugd/e6092c_356ed2ac513a46d8a9561cbdbecfaaef.pdf
    • https://static.usrfiles.com/ugd/b8c837_2f1d43a79d42465ea811eaa6c8d4cbc0.pdf
    • https://static.usrfiles.com/ugd/9eb187_70eb27ef05044f34934055ab6c65416b.pdf
    • https://static.usrfiles.com/ugd/8acad3_a4fa8a9fd82e4494819ca5b6c9dffe7e.pdf
    • https://static.usrfiles.com/ugd/930050_7581cf217b544bce808c30c22db9abd4.pdf
    • https://static.usrfiles.com/ugd/405339_81f501478e5d4b359b8d8d30b0066070.pdf
    • https://static.usrfiles.com/ugd/d2751c_b9dafd0a351a43d591817718c1c4f2b3.pdf
    • https://static.usrfiles.com/ugd/576447_cd34919101844a8ba8e143cfd189bdd7.pdf
    • https://cdn.shopify.com/s/files/1/0434/1134/1479/files/88583037022.pdf
    • https://cdn.shopify.com/s/files/1/0431/2095/1450/files/microeconomics_in_modules_3rd_edition.pdf
    • https://cdn.shopify.com/s/files/1/0428/8079/4780/files/zudasepidedix.pdf
    • https://cdn.shopify.com/s/files/1/0433/6454/8762/files/positive_and_negative_effects_of_mobile_phones_on_students.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005821.bin
09df8d263043760015df23160a8eddedba591083e9b87ff2f296b4fdf67ed801		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5821 5024 bytes
font_01_sfnt_off00006956.bin
bee45b03e0c886240395efa311558088302d8258307e879c67018e9796bd957c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6956 12832 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.