Malicious PDF — malware analysis report

Static analysis result for SHA-256 50b05af52f01ff57…

MALICIOUS

PDF

44.5 KB Created: 2020-08-31 01:49:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4037229a0007c81479e009de96b6aae5 SHA-1: 644e0571aaf72e163e51510fa8cac4bf0ddf022c SHA-256: 50b05af52f01ff57748397b6b92cd5388896909d8625fd2af18731813b1a8b42
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.001 Malicious Link T1059.001 PowerShell

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'https://ttraff.cc/wix?keyword=drunken+wrestlers+game'. This URL is presented within the document body, suggesting a lure to a malicious site. The PDF also exhibits characteristics of a link farm, with numerous embedded links, many of which point to static.usrfiles.com. The primary malicious URL is the most critical IOC.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=drunken+wrestlers+game
    • https://static.usrfiles.com/ugd/105a8c_45f193613a064ab08f4d833e9ff02bc4.pdf
    • https://static.usrfiles.com/ugd/b8c837_a9006dcd00db4a1ba164894ddcfa0059.pdf
    • https://static.usrfiles.com/ugd/b8c837_3e8ed6ff45f241b4af717fcd1fba23be.pdf
    • https://static.usrfiles.com/ugd/32acb1_ef0cc16e65434650b43b5ce0fe69f589.pdf
    • https://static.usrfiles.com/ugd/37428b_f8ba99880c3e425c97dd998a58425f1e.pdf
    • https://static.usrfiles.com/ugd/b8c837_39b70d8bed95487c88a558d717dc91f5.pdf
    • https://static.usrfiles.com/ugd/a2e20a_6f1ebecc45e44f068b06973b398fb318.pdf
    • https://static.usrfiles.com/ugd/7f16bd_0d6720161d58417089b157228a58abe8.pdf
    • https://static.usrfiles.com/ugd/d01287_169177f12c2e430080c135762ec52a91.pdf
    • https://cdn.shopify.com/s/files/1/0431/8819/1394/files/39546749299.pdf
    • https://cdn.shopify.com/s/files/1/0433/4419/9829/files/31345969825.pdf
    • https://cdn.shopify.com/s/files/1/0433/0127/3768/files/mefozesilogawudagugepa.pdf
    • https://cdn.shopify.com/s/files/1/0432/2807/0052/files/puvinof.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000046fd.bin
d2bc616f631accbae3af9616ddac4a0a4447a3b0d3e79c85981eaa8e613e72a9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x46FD 4884 bytes
font_01_sfnt_off00005790.bin
f0488a72bb65c39ba4d2034ba59c19b64259ce55909fdb45a461f1c38160a626		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5790 10264 bytes
font_02_sfnt_off00007a9f.bin
501292cbb881a91b73b1efdcb6e57880c7fb43769a5be9083faf7e713199ce8f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7A9F 18304 bytes
font_03_sfnt_off000096d7.bin
cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34		 pdf-font-stream PDF embedded font (sfnt) at offset 0x96D7 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.