Malicious PDF — malware analysis report

Static analysis result for SHA-256 3753e097fcc95538…

MALICIOUS

PDF

111.8 KB Created: 2020-09-07 16:09:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 01cb73ea7a150143f71b0fa22e1fadc6 SHA-1: d55f9b5749c4a185d62ec621055a7d5ab6205e78 SHA-256: 3753e097fcc95538a7bd6a03dba67af344c3fa1e68345f55aee7e2c7173feef1
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a link to a redirector (ttraff.cc) which is flagged as malicious. The document also exhibits characteristics of an advance-fee scam, using a lure related to 'biofuels in south africa pdf' to entice clicks. The presence of a mass external PDF link farm further supports the malicious intent, likely to distribute further lures or malware. No scripts were extracted, but the embedded URL is the primary indicator of compromise.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=biofuels+in+south+africa+pdf
    • https://static.usrfiles.com/ugd/b8c837_664249c81da44ab2969ba9e06293e833.pdf
    • https://static.usrfiles.com/ugd/b8c837_ebaa5da43e824dd68ca5ff8a5f2a29fc.pdf
    • https://static.usrfiles.com/ugd/bb05c1_1d5f8f66803049568a9d2c559ae9e4c7.pdf
    • https://static.usrfiles.com/ugd/911c12_91840fdf58ec4750977f78eedb00e818.pdf
    • https://static.usrfiles.com/ugd/b8c837_8f8ef4fdabd7440c9452d65214075379.pdf
    • https://static.usrfiles.com/ugd/fbccce_70bda7180ac4476990a487ae558354f2.pdf
    • https://static.usrfiles.com/ugd/d1c05f_c25ab22257b04a369dc3a7fa36479de8.pdf
    • https://static.usrfiles.com/ugd/6c98bc_e6c3b94d1edf40f78e8a599d3f64a8cb.pdf
    • https://static.usrfiles.com/ugd/4d935e_4daf144de1fc4c6e82b4f57ca4f30a88.pdf
    • https://static.usrfiles.com/ugd/b8c837_5ab88d13d7d44d0288ab190757688216.pdf
    • https://static.usrfiles.com/ugd/764aaa_374c23ef4fc14f56b7f9b062bcaaa6f4.pdf
    • https://static.usrfiles.com/ugd/800b88_ead5f00bae054c06b8e08590d0acef15.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00017ac2.bin
bf6c77f0acf021d40964b97028c006c83dbee31f9c9d7da0ea90499ef2d9aa39		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17AC2 5292 bytes
font_01_sfnt_off00018cbc.bin
5ca82ab86b1a2535ff08a47665adaef58a921289c659f2dc8ae784a88698996c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x18CBC 11196 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.