Malicious PDF — malware analysis report

Static analysis result for SHA-256 5653341b2c29400a…

MALICIOUS

PDF

50.8 KB Created: 2020-09-01 20:25:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8cfb70101365cf457f484afafa25d910 SHA-1: d01dd2c5698d3a33cedc47cf767634ba76a6315d SHA-256: 5653341b2c29400adb04e66a74187483facb4dbababd5335e42c802e4864b931
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a significant number of external links, identified as a PDF link farm. One of these links, 'https://ttraff.cc/wix?keyword=brockhampton+saturation+iii+zip', is flagged as a known malicious redirector. The presence of a link farm and a malicious redirector suggests an attempt to direct users to harmful content, likely for phishing or malware distribution.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=brockhampton+saturation+iii+zip
    • https://static.usrfiles.com/ugd/735189_69526549329f4be690c297a591e2ffa5.pdf
    • https://static.usrfiles.com/ugd/1df9ea_54e7fa8b36384438b9861bbcb44b8af0.pdf
    • https://static.usrfiles.com/ugd/46429b_7fb72485686e40b1b29c81aad863f1c8.pdf
    • https://cdn.shopify.com/s/files/1/0434/1760/0156/files/6645004677.pdf
    • https://cdn.shopify.com/s/files/1/0432/0965/4436/files/damipotubuwis.pdf
    • https://cdn.shopify.com/s/files/1/0463/1933/7632/files/ben_10_omniverse_aliens_transformations.pdf
    • https://cdn.shopify.com/s/files/1/0437/5068/6874/files/speed_test_internet_connection_free.pdf
    • https://cdn.shopify.com/s/files/1/0434/3506/5510/files/19807016113.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/32829552166.pdf
    • https://cdn.shopify.com/s/files/1/0435/2140/9184/files/sebavur.pdf
    • https://cdn.shopify.com/s/files/1/0427/5562/1031/files/komoluxebizavobupizu.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/29121996303.pdf
    • https://cdn.shopify.com/s/files/1/0433/6851/3695/files/oecd_guideline_473_in_vitro_mammalian_chromosome_aberration_test.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006fa5.bin
c6e6eb19c855552c53951eba306b74c910ac2aaa59b93ee61e89ac935b21fd43		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6FA5 5068 bytes
font_01_sfnt_off000080af.bin
afd1a2d0e1cda14270dcd772ac8b93f34a5cde0ec69ea0aeaa7d824052dc450b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x80AF 15332 bytes
font_02_sfnt_off0000b04b.bin
1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB04B 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.