Malicious PDF — malware analysis report

Static analysis result for SHA-256 56ea4af757c9b3a8…

MALICIOUS

PDF

67.0 KB Created: 2020-09-10 21:38:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 038b81cebf60b58a388b7fa1bf0705be SHA-1: d46b7cf93ceb9e7839b318a9cc925b6e79cb8a69 SHA-256: 56ea4af757c9b3a8996eac9e7cff590718c62d9193391550833136b5c32c92e2
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF file contains a link farm and a direct link to a known malicious redirector, indicating a social engineering attempt to lead the user to malicious content. The heuristic 'SE_CLIPBOARD_COMMAND_LURE' suggests the document may also instruct the user to execute commands, further supporting a malicious intent. The primary goal appears to be directing the user to the 'ttraff.com' URL, likely for further exploitation or credential harvesting.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE
    Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=macos+catalina+hackintosh+guide
    • http://torij.aliveleadership.com/uploads/1/3/1/1/131164250/gofuwed-wamarokas-todejenotozune-nuralu.pdf
    • http://files.malagpr.com.au/uploads/1/3/1/0/131069887/7442725.pdf
    • http://vonugojev.hawaiivoiceandspeechstudio.com/uploads/1/3/0/9/130969431/9386164.pdf
    • http://files.mcaprint.co.uk/uploads/1/3/1/6/131607095/7a09b6c.pdf
    • http://sapifex.hiddenoakshoa.org/uploads/1/3/2/6/132682989/85d144bc7.pdf
    • http://files.birnamwoodlabs.com/uploads/1/3/0/8/130874490/lodidixeka-gavabojofa-velukaxutuxabo-bijawoju.pdf
    • http://files.sjbcatholicredbud.com/uploads/1/3/2/8/132814589/posewuxexokuxugopo.pdf
    • http://files.johnedwardwalsh.com/uploads/1/3/1/4/131406435/985bb1bd.pdf
    • http://files.themobilepcguys.com/uploads/1/3/1/4/131407761/felusebagofi-famodi-bopuzegofu-zodovoga.pdf
    • https://static.usrfiles.com/ugd/accd1f_09d7d052fa0046b9ab231f300cffe557.pdf
    • https://static.usrfiles.com/ugd/f4de5e_69f69f3902bb4dc2a95dcabea7f2097c.pdf
    • https://static.usrfiles.com/ugd/ec0012_a9c2ddc32daf48daa93b1bbe4b2877e9.pdf
    • https://static.usrfiles.com/ugd/83b1b3_46c37beed84a4e3b8c1230aeb1fc18f1.pdf
    • https://static.usrfiles.com/ugd/8e1900_af7ef81edf0f4dc4a70838016b3fd204.pdf
    • https://static.usrfiles.com/ugd/7836c9_4989896032e74fa58c6c6d9708b2790f.pdf
    • https://static.usrfiles.com/ugd/2dbf5a_23d36f730ba643c48c0361eaf1d57baf.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000a8a6.bin
9aeee77d5257e68e3fc1fc9752515e66b2e1d9d5267aab84c0637252f4d754a7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA8A6 5176 bytes
font_01_sfnt_off0000ba3d.bin
a44e0b6e950dd3c8403a3770a9a8a46d56e7a67c4e9660571306142c077ce838		 pdf-font-stream PDF embedded font (sfnt) at offset 0xBA3D 2236 bytes
font_02_sfnt_off0000c46b.bin
212b8fc6ffaa199383397bb1f7204b6dffd898685718b6b668e2bdddbdc20143		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC46B 10212 bytes
font_03_sfnt_off0000e7a9.bin
bf0029f2f65a8d03fc5bc6dac3f89872448ee76276b38fcd79a4881ba082e330		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE7A9 16508 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.