Malicious PDF — malware analysis report

Static analysis result for SHA-256 4767371a57cf9f44…

MALICIOUS

PDF

71.4 KB Created: 2020-08-31 10:42:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 87f2e97bd4243f35d3516797f5a78f24 SHA-1: 07d18207ad8ac9f60a64d67c57b5e557cf85fed4 SHA-256: 4767371a57cf9f4453038e49768d69cc913d2c4b00cc2814da38e092e65e9f6e
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a heuristic firing for a malicious redirector link pointing to 'https://ttraff.com/wix?keyword=ap+world+history+reading+guide+answers'. This URL is presented within the document body, disguised as a study guide answer key, to entice users to click it. The PDF also exhibits characteristics of a link farm, with numerous embedded URLs, many hosted on 'static.usrfiles.com'. The primary malicious URL is the most critical IOC.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=ap+world+history+reading+guide+answers
    • https://static.usrfiles.com/ugd/9b5f63_30ea47b032c94fb18cb8ec9585cbe7bf.pdf
    • https://static.usrfiles.com/ugd/83b1b3_2efe22b28c9f433ab8cbf7cc25ac5d84.pdf
    • https://static.usrfiles.com/ugd/b8c837_13904c4f41c241c282d43c591d4faf7b.pdf
    • https://cdn.shopify.com/s/files/1/0431/5663/5805/files/69615414014.pdf
    • https://cdn.shopify.com/s/files/1/0432/6513/0658/files/88120603290.pdf
    • https://cdn.shopify.com/s/files/1/0435/3058/4213/files/27449747000.pdf
    • https://static.usrfiles.com/ugd/b8c837_686d58db60e045199d90aaa4655c0b4b.pdf
    • https://static.usrfiles.com/ugd/b8c837_9a260537d8644b40bfbab4801e197c7f.pdf
    • https://static.usrfiles.com/ugd/c1108c_710f738740f14b139cbe805742911835.pdf
    • https://static.usrfiles.com/ugd/a771bd_97c42d720b494f7ab86ad2bb99c8d0f1.pdf
    • https://static.usrfiles.com/ugd/9e14ca_93ce91fafbdd463d9b38b057c5630bee.pdf
    • https://static.usrfiles.com/ugd/b8c837_f1c22cce53d44ffab0fb13b1d5cecbab.pdf
    • https://static.usrfiles.com/ugd/b8c837_2f3a53aed817421298ef206ac3598351.pdf
    • https://static.usrfiles.com/ugd/b8c837_3a4ea0cd60014030b103700e0c3e7d7e.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000068d6.bin
cfd810a5ea282119da4c1abf509a1e6bf8c77e42bfdbea3e308bbcdcc7c40f73		 pdf-font-stream PDF embedded font (sfnt) at offset 0x68D6 6872 bytes
font_01_sfnt_off00007a2c.bin
5d4668740cc05fe738d59754a1e5943b1e2543179c7ac5f79caebf13bf57081e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7A2C 5404 bytes
font_02_sfnt_off00008c91.bin
3c4bb5fb1d39812cada2b58d81bc687bbd191738486d7e1ef0c88f5c536889ba		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8C91 23720 bytes
font_03_sfnt_off0000cd39.bin
213e16327f9332b66a9d5198ee4bca041579eddd68ac37125b6b71a3d73804ff		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCD39 10788 bytes
font_04_sfnt_off0000f17e.bin
8d489ea55310a719cf5f973c213923a8a50238e4bef290c93e06e5a0d7a618b3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF17E 16464 bytes
font_05_sfnt_off000107b2.bin
0d9b6ab0354368cdfa5a4e52e4dfb250ede80cec4283e48fafec0a3c1c1d30df		 pdf-font-stream PDF embedded font (sfnt) at offset 0x107B2 1736 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.