Malicious PDF — malware analysis report

Static analysis result for SHA-256 289af6d4256d06f3…

MALICIOUS

PDF

45.8 KB Created: 2020-09-09 10:26:19 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 54cc8822a446ebf235b41f87e074ba6b SHA-1: 33e466cc6b94eae5bbf47ce9dd5b6df23a16b542 SHA-256: 289af6d4256d06f3b33ed82a553adf6f22d19cdd6403cfa766c82f2cc3b3d384
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, many of which point to a redirector service. The primary malicious link, 'https://ttraff.link/wix?keyword=roll+of+galvanized+sheet+metal', is designed to lure users to potentially harmful content. The document body, though heavily obfuscated, contains references to this URL and other benign-looking PDF links, suggesting a link farm or redirection tactic to obscure the final malicious destination.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/wix?keyword=roll+of+galvanized+sheet+metal
    • https://static.usrfiles.com/ugd/590778_ffbbb91cec9a44efa03b69e165bf3373.pdf
    • https://static.usrfiles.com/ugd/909b15_27eaeb8bd77844838e8d010866716a47.pdf
    • https://static.usrfiles.com/ugd/93971e_f771af6acc5140f485501afbaad41700.pdf
    • https://static.usrfiles.com/ugd/f67134_73986e827ebc4bdb978fc74673794b6e.pdf
    • https://static.usrfiles.com/ugd/b8c837_d2fc01be6ca84681814b5d766f228403.pdf
    • https://static.usrfiles.com/ugd/e7e4a0_4ad747e2996748168ffefb14935e000d.pdf
    • https://static.usrfiles.com/ugd/e2c250_4a133ef7340b4662b69922931a9741d2.pdf
    • https://static.usrfiles.com/ugd/b8c837_7a7bfa148a58420d9e372c99d0b7c051.pdf
    • https://static.usrfiles.com/ugd/e948c1_5f863116712d48f2ac0f1c4266059fca.pdf
    • https://static.usrfiles.com/ugd/270e53_4a80f2a22b7e471da0bd369f3ba968c5.pdf
    • https://static.usrfiles.com/ugd/d31907_19f4bf6da41b4f1c815073525b4a714e.pdf
    • https://static.usrfiles.com/ugd/b8c837_d628ed0e895649dd89fe66bc85ae17fc.pdf
    • https://static.usrfiles.com/ugd/06497e_9e2aec37fe0f47b29a908be089682cf6.pdf
    • https://static.usrfiles.com/ugd/035627_c9126a0c854f4aadb7c544a9bcb2abe8.pdf
    • https://static.usrfiles.com/ugd/c068f8_cf3d3c8c05864ad89e4a39a69fc42045.pdf
    • https://static.usrfiles.com/ugd/e4a001_e242ba21ff62449ab38fa3d8bfb64acb.pdf
    • https://static.usrfiles.com/ugd/b8c837_a51bde549a4b435ea3aabcaf1a2a355d.pdf
    • https://static.usrfiles.com/ugd/115d6e_c49240c1b1de499abb591174f88eed22.pdf
    • https://static.usrfiles.com/ugd/61804c_7f8a38da65e24d02a37454141876f995.pdf
    • https://static.usrfiles.com/ugd/04c368_9c517b4a6fda465da3938f222df59b1e.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000067dd.bin
7aa30edf115f77428e5d4a7bd0060b92ffd521f4d2ecd1e96d21c036dbc9c1f3
pdf-font-stream PDF embedded font (sfnt) at offset 0x67DD 5344 bytes
font_01_sfnt_off000079fc.bin
0aebe354e73544783c03fd5a4aae3da1d7e7b42686aa5cd987f65c0b605321e9
pdf-font-stream PDF embedded font (sfnt) at offset 0x79FC 15420 bytes