Malicious PDF — malware analysis report

Static analysis result for SHA-256 4608acaca8a9be50…

MALICIOUS

PDF

43.9 KB Created: 2020-08-30 07:02:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6cdf7de3a4e0f4df56664f56d6317f17 SHA-1: 11a8029a3a1c0d2ac260b9c6702033015950cccc SHA-256: 4608acaca8a9be508c382dc74a95534e07da7ff868ce44b37849095772a73215
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a critical heuristic firing for a malicious redirector link pointing to a survival mod APK download. It also exhibits a PDF link farm heuristic, with numerous links to static.usrfiles.com, likely for SEO poisoning or to obscure the malicious redirector. The document body contains the malicious URL, reinforcing the lure.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=survival+mod+apk
    • https://static.usrfiles.com/ugd/e3325f_1ffbbf554df84553a10d9f1a9174016b.pdf
    • https://static.usrfiles.com/ugd/01e791_95d5d02161944ca2b4fbffb25197c016.pdf
    • https://static.usrfiles.com/ugd/1b8612_51da65900e81482db47105a708c4aac5.pdf
    • https://static.usrfiles.com/ugd/57c819_544f2ef67984499382c63c5ca4188dc5.pdf
    • https://static.usrfiles.com/ugd/b8c837_b2221ff361a9486cbb9e7216a1bcb6bd.pdf
    • https://static.usrfiles.com/ugd/cafc24_f50bcef046b340bd9cc04c1e7e134b9a.pdf
    • https://static.usrfiles.com/ugd/837d34_5d022d0bf6204f0e8e563bd84fb8a99a.pdf
    • https://static.usrfiles.com/ugd/a2d007_d8125154b3354760be706a7502118da5.pdf
    • https://static.usrfiles.com/ugd/e3c460_45bfa6f102f34f8ba3c1643a67836535.pdf
    • https://static.usrfiles.com/ugd/09273f_7b412eef308b4428a377eb47a0b0d63b.pdf
    • https://static.usrfiles.com/ugd/82e28d_3bbfc4c9af3b412ab314aaa1e8a79ec6.pdf
    • https://static.usrfiles.com/ugd/e2c6c1_ee7f832472b34dcb931971088e00757b.pdf
    • https://static.usrfiles.com/ugd/b8c837_6f31e5b92342443bbf0fd6b95516c983.pdf
    • https://cdn.shopify.com/s/files/1/0431/9733/3668/files/wusovaxebotaje.pdf
    • https://cdn.shopify.com/s/files/1/0436/9213/0458/files/lomukilebiputaforuzuvaji.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006224.bin
43a7cd530781f4f2ffe17c90caf993ab29d17f377fe0db8609d58c72ada4d29d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6224 4732 bytes
font_01_sfnt_off0000722b.bin
3c3b0b8cce038131253e4f8e409b4bb2602352f4ea7d1d856a8da7693085b899		 pdf-font-stream PDF embedded font (sfnt) at offset 0x722B 10128 bytes
font_02_sfnt_off000094dd.bin
1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x94DD 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.