Malicious PDF — malware analysis report

Static analysis result for SHA-256 22f4ef414770ea44…

MALICIOUS

PDF

57.1 KB Created: 2020-08-30 01:26:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3e0a9def22b36ffb68953bc7574658a0 SHA-1: 8eb698ec3ea58750e188b056634581cc0adefd14 SHA-256: 22f4ef414770ea44a6ff6bd2df4cbc35a3fee3647ba0e508f28c6f970595f2a5
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was identified as malicious due to its structure, which includes a large number of embedded links pointing to external PDF documents. One of these links, https://ttraff.cc/wix?keyword=definicion+de+proporcionalidad+direc, is flagged as a known malicious redirector. The presence of a link farm and a malicious redirector suggests an attempt to lure users to malicious content, likely for phishing or malware distribution.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=definicion+de+proporcionalidad+direc
    • https://static.usrfiles.com/ugd/4cf28d_1194c745eaee49f582e81ddea3c7532c.pdf
    • https://static.usrfiles.com/ugd/0aab01_28915f81bf2842e7b3709707da80338b.pdf
    • https://static.usrfiles.com/ugd/a59130_3edf02095a994653b61d385b30150ef0.pdf
    • https://static.usrfiles.com/ugd/2b25b5_2bd6d132ed704910af70cb2032fef95b.pdf
    • https://static.usrfiles.com/ugd/b8c837_b45adb783ca347aa864882c616feae88.pdf
    • https://static.usrfiles.com/ugd/b8c837_95e5cb01b1154f729be73f86dfc0e7f6.pdf
    • https://static.usrfiles.com/ugd/6846fe_eaad77a3a86547d2a4293ea6c7d8137f.pdf
    • https://static.usrfiles.com/ugd/affaa6_439c23459e8c4c24bf8e9566d6a64726.pdf
    • https://static.usrfiles.com/ugd/b8c837_e5a80f47e18540c9970a3db75374a0a2.pdf
    • https://static.usrfiles.com/ugd/158fb9_3ed5a5cc813740f9a7d8fac1e029dc4f.pdf
    • https://static.usrfiles.com/ugd/4bb894_c010c527da8841299dca3236861b6df8.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007fb3.bin
ceee9baf0124ebfdb305191c583f1bc8ba569916856d3064479b1aaa567d5ab7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7FB3 4968 bytes
font_01_sfnt_off000090a8.bin
b0ee315b601ca44ba896c5c08b784f79ab8dc1574c867ba0461e0a525749cb90		 pdf-font-stream PDF embedded font (sfnt) at offset 0x90A8 15136 bytes
font_02_sfnt_off0000bfad.bin
e2ae9b31c51f348c4102034e14e28d4c0c38c00d03e7bdad1cf9517181d66dd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xBFAD 16380 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.