Malicious PDF — malware analysis report

Static analysis result for SHA-256 25bc5a60e8cdab1a…

MALICIOUS

PDF

41.2 KB Created: 2020-08-31 06:13:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7b8ceae8e561c57d55da3a2216ddd611 SHA-1: e62c4f8d6b9dfe443563ba6805814d37aa9ab8e5 SHA-256: 25bc5a60e8cdab1a0c51dfa072b764473283fc3f1fd370aa14cfa93dfac90484
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a significant number of embedded links, identified as a link farm. One of these links, https://ttraff.cc/wix?keyword=barbell+and+dumbbell+only+workout+plan, points to known malicious redirector infrastructure. The document body, though heavily obfuscated, appears to contain text related to workout plans, suggesting a lure to entice users to click the malicious links. The presence of a link farm and a malicious redirector strongly indicates an attempt to lead users to a malicious site.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=barbell+and+dumbbell+only+workout+plan
    • https://static.usrfiles.com/ugd/913720_37960b2bad544f7599dcfca4023d4556.pdf
    • https://static.usrfiles.com/ugd/e2f197_b383ae97847f4e5a9dd15fb223e416ec.pdf
    • https://static.usrfiles.com/ugd/b8c837_12f9d3d6161947c6aca4565ed9c2ee0d.pdf
    • https://static.usrfiles.com/ugd/b8c837_10c165ccca2648dea3ce9a573b0be4fb.pdf
    • https://static.usrfiles.com/ugd/79e0dc_fb90f44f48524bf09c7d1d6e43a7e442.pdf
    • https://static.usrfiles.com/ugd/1e4819_1de21901d41f4ed8ad8c0ca13ee672fb.pdf
    • https://static.usrfiles.com/ugd/5ecadc_f38f75dbf9ea4318a5ffe2b2a7bab242.pdf
    • https://cdn.shopify.com/s/files/1/0431/0820/4708/files/84968954928.pdf
    • https://cdn.shopify.com/s/files/1/0434/8870/6717/files/41591338188.pdf
    • https://cdn.shopify.com/s/files/1/0434/3844/0604/files/zitudemomojini.pdf
    • https://static.usrfiles.com/ugd/10a4aa_8634337137af4305aca608fff750da09.pdf
    • https://static.usrfiles.com/ugd/a382ee_2736ea7042d743018d15d045a08d333a.pdf
    • https://static.usrfiles.com/ugd/5ed537_757c6146d2d64ef1aad601f05b151749.pdf
    • https://static.usrfiles.com/ugd/b8c837_b22f59b59907468798f4fda32dbf3f5f.pdf
    • https://static.usrfiles.com/ugd/b48b60_66d4606c00c34f8ba8b7695b38eba415.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006292.bin
7497d97a76f618d43dc461355bf8cc3540eb5ab71ca39757f3b2b60bc6e4c24b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6292 5376 bytes
font_01_sfnt_off000074d5.bin
bbebdc2b94127fd9d1cf05899a77ecd2768da057fd7b232617dc247ac72ab36b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x74D5 10240 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.