Malicious PDF — malware analysis report

Static analysis result for SHA-256 202e5b426e88dbfa…

MALICIOUS

PDF

47.2 KB Created: 2020-08-30 02:50:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: dadfc3aa11f016e0e2ddc12b5a3326e1 SHA-1: bc3da06bb56e9d3d420b05ee78c32e74cd75ac71 SHA-256: 202e5b426e88dbfa927427c0e9ea77e0bd30dfecdb137c332e1d87041176c273
128 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious Link T1566.002 Spearphishing Attachment

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.cc/wix?keyword=pandigital+scan2pc+software+download'. Additionally, it exhibits characteristics of a PDF link farm, with numerous links to external PDFs hosted on 'static.usrfiles.com'. The presence of a visual download button lure further supports a malicious intent to trick the user into downloading unwanted content.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=pandigital+scan2pc+software+download
    • https://static.usrfiles.com/ugd/39cb9d_6a2b9392c91e4da788ec9d54f5cf9cba.pdf
    • https://static.usrfiles.com/ugd/ca9b0a_fb642a32ada34faaa954c6ed912db1e4.pdf
    • https://static.usrfiles.com/ugd/b8c837_e3c5f7b5177842d1a8af5e3d7de42d29.pdf
    • https://static.usrfiles.com/ugd/b3bc21_78987f461be14cd28bfce4c6510b2f4d.pdf
    • https://static.usrfiles.com/ugd/b8c837_456d002bd15c4264bd5030bdd5c535c5.pdf
    • https://static.usrfiles.com/ugd/1849a1_0a43f38097d8475ea8b330d4f1b08fb8.pdf
    • https://static.usrfiles.com/ugd/b8c837_a47a680e4ec94322a405f54667ff81ba.pdf
    • https://static.usrfiles.com/ugd/6908d7_22b363c86b2f497eb0e88df6caf3571f.pdf
    • https://static.usrfiles.com/ugd/d2751c_164544551bd148d19c642ae95569adca.pdf
    • https://cdn.shopify.com/s/files/1/0437/0425/4615/files/crown_of_thorns_starfish_worksheet.pdf
    • https://cdn.shopify.com/s/files/1/0432/2433/4498/files/70376701322.pdf
    • https://cdn.shopify.com/s/files/1/0437/4082/3706/files/divinity_une_affaire_de_famille.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006b7c.bin
83fd5f3cea15c3e86f6ed583ae340682d573a7d72643e8469fbc1263d7ece785		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6B7C 5548 bytes
font_01_sfnt_off00007e77.bin
bba2a8db98b4ef8fde5cf90b745de949dc3d60006e328c81028042acfd47abe5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7E77 15356 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.