Malicious PDF — malware analysis report

Static analysis result for SHA-256 2dc93b39e8142cff…

MALICIOUS

PDF

42.5 KB Created: 2020-08-31 08:03:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ffc5a18ffda37bbc53f00781f4eba654 SHA-1: e179364410a3ec90c616ba024b4a8bf910a7f909 SHA-256: 2dc93b39e8142cffe09fcc9268e8953134ded6cb0ce2ec9ae93546097ce6e7e2
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1200 Hardware Add-in T1059.001 PowerShell

The PDF file contains a link farm, with multiple embedded URLs pointing to external PDF documents. One of these URLs, 'https://ttraff.cc/wix?keyword=problems+from+philosophy+rachels+3rd', is identified as a malicious redirector. The document body, though heavily obfuscated, also contains this URL, suggesting an attempt to lure the user to malicious infrastructure. No scripts were extracted from this sample.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=problems+from+philosophy+rachels+3rd
    • https://static.usrfiles.com/ugd/b77b08_cfe65b71d22c4c65815ab80cafaebb8a.pdf
    • https://static.usrfiles.com/ugd/af0aa9_fb61200e66684860826e7d575202ead7.pdf
    • https://static.usrfiles.com/ugd/0cd019_4586ba74b1534f7489b1cba4ff59b1b5.pdf
    • https://static.usrfiles.com/ugd/76b6de_b9b82b88e07c479c908b0835c04193e2.pdf
    • https://cdn.shopify.com/s/files/1/0432/3636/0351/files/alteraciones_del_lenguaje_en_nios.pdf
    • https://cdn.shopify.com/s/files/1/0439/1147/9464/files/drug_abuse_essay_in_english.pdf
    • https://static.usrfiles.com/ugd/f0e51d_a1585a18160244d5813e9a6ed41b9181.pdf
    • https://static.usrfiles.com/ugd/9c0842_c9b03303b876430bbda61a7ef61875ed.pdf
    • https://static.usrfiles.com/ugd/b28561_9dd8ef2fe0d543679588e6c3b027cece.pdf
    • https://static.usrfiles.com/ugd/b8c837_ca7bd45308a040af9b29010b968ec1ce.pdf
    • https://static.usrfiles.com/ugd/345929_3a622593a1874d4789c20eb12f11b981.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006748.bin
285808d87e1f8711c423d344e6e6d475026e48c6bdec2f0f8781e44df20ab6f2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6748 5800 bytes
font_01_sfnt_off00007adc.bin
648a1d5ed0f3e7cbb4ff3570b6392f2be5598bcd4d1862fbfc2c22a10c7b5cf0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7ADC 10176 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.