Malicious PDF — malware analysis report

Static analysis result for SHA-256 3c318105d8e42fb8…

MALICIOUS

PDF

41.0 KB Created: 2020-08-30 01:22:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8c8b808c15fbb426c8b4781276399d56 SHA-1: 078901b9565cb4b802fe4ea94032baddf77c733d SHA-256: 3c318105d8e42fb8d202e3ca0c375a5e113085e30f97d638f9220595a02b0db2
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a link that redirects to a known malicious domain, disguised with keywords like 'smite speed hack' to entice clicks. The document body and embedded link structure suggest a social engineering lure. The PDF also contains a large number of external links, many pointing to static.usrfiles.com, which is likely part of a link farm to improve search engine ranking for malicious content.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=smite+speed+hack
    • https://static.usrfiles.com/ugd/b8c837_dce3492ddc904da6843f81230637b7e9.pdf
    • https://static.usrfiles.com/ugd/b8c837_978807e56de54f349a07b62d60a29d97.pdf
    • https://static.usrfiles.com/ugd/3eed2b_06bf8f4e96ca4befa2bc1b8990098097.pdf
    • https://static.usrfiles.com/ugd/b8c837_f68bb4c00cd64a19912674786f0f43a7.pdf
    • https://static.usrfiles.com/ugd/b8c837_e5ee22d5d4194382b5ba869f65d86ee1.pdf
    • https://cdn.shopify.com/s/files/1/0434/4178/2946/files/vimimu.pdf
    • https://cdn.shopify.com/s/files/1/0429/7926/2615/files/scratch_coding_games.pdf
    • https://cdn.shopify.com/s/files/1/0434/0688/5020/files/zotel.pdf
    • https://static.usrfiles.com/ugd/b5aed9_90c74a2ffaae4d4cb51e186b4f0f65f6.pdf
    • https://static.usrfiles.com/ugd/0aab01_a84426539e794c2cab50875cf4fa2346.pdf
    • https://static.usrfiles.com/ugd/b8c837_e1170fe5bb9b42beaf18c4ff951fc045.pdf
    • https://static.usrfiles.com/ugd/7f46b5_c9ec80212c394c5e8c94c20ae67b1255.pdf
    • https://static.usrfiles.com/ugd/b8c837_bc503f24417b462ea3bc3be0090d796d.pdf
    • https://static.usrfiles.com/ugd/3aca14_051ee05707a9470a8f7e5581880dad8d.pdf
    • https://static.usrfiles.com/ugd/36f25b_f23686e003bb40438666d72a80402545.pdf
    • https://static.usrfiles.com/ugd/b8c837_2fe25d6526324c378ceb3e72ea834f89.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000603e.bin
835c2bb50c89599e89889a3f9c0afb2997540219a918ba5eb8a100c12e72b415		 pdf-font-stream PDF embedded font (sfnt) at offset 0x603E 5352 bytes
font_01_sfnt_off0000724c.bin
0d8251812991fa5eadd60c61be8afa2d6998c48ca8f983f9e4a738b07aceae9a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x724C 10892 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.