Malicious PDF — malware analysis report

Static analysis result for SHA-256 7b4e3eef492edde1…

MALICIOUS

PDF

38.3 KB Created: 2020-08-30 09:03:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 47e4eb412052c3509da650332c4e6768 SHA-1: e08fe60a083c1c0726bad9a22bd820bed47c4683 SHA-256: 7b4e3eef492edde1b82d0847872364a573b94937ad2b79d44a673f031f154ee7
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a critical heuristic firing for a malicious redirector link, pointing to ttraff.ru. This URL is presented within the document body, disguised as a link to download an Excel file for personnel tracking. The PDF also exhibits characteristics of a link farm, with numerous external links, many hosted on static.usrfiles.com. The primary malicious IOC is the redirector URL, which likely serves as a gateway to further malicious content or exploits.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=personel+maa%25C5%259F+takip+program%25C4%25B1+excel+indir
    • https://static.usrfiles.com/ugd/f515ca_1b015752fa2c42de9ce97126d388b3af.pdf
    • https://static.usrfiles.com/ugd/760101_a53e5acc1e4d4d20a41f9dbed5dd7c63.pdf
    • https://static.usrfiles.com/ugd/b8c837_e7493162631d4435b092bae9165f26ed.pdf
    • https://static.usrfiles.com/ugd/0511f5_d55ede54eee04ca9b70e0162b42e61ff.pdf
    • https://cdn.shopify.com/s/files/1/0427/6623/7852/files/handbook_of_utility_theory.pdf
    • https://cdn.shopify.com/s/files/1/0433/0278/1083/files/98557554622.pdf
    • https://cdn.shopify.com/s/files/1/0464/1069/4824/files/foxhole_radio_backpack.pdf
    • https://cdn.shopify.com/s/files/1/0433/8669/9925/files/85555036615.pdf
    • https://cdn.shopify.com/s/files/1/0431/4667/4330/files/purpose_driven_life_ebook_download_free.pdf
    • https://static.usrfiles.com/ugd/b8c837_a932183e82f7499681b2072342856939.pdf
    • https://static.usrfiles.com/ugd/b8c837_241b7401b0894806bcb139ab019b1ac7.pdf
    • https://static.usrfiles.com/ugd/b8c837_05e071803c274243bc1f846768ad98dc.pdf
    • https://static.usrfiles.com/ugd/b8c837_b3c6ca8ab3c047ce8bc65f36f4d9e784.pdf
    • https://static.usrfiles.com/ugd/432b07_0653d64640e347cc969fbfd5680a36b3.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000520c.bin
37a124df7cb5ba9ec71256ff084fba1065bc8d6a9e013b83564a54ba17ca5110		 pdf-font-stream PDF embedded font (sfnt) at offset 0x520C 5804 bytes
font_01_sfnt_off00006533.bin
a30893d443bf0617b73470e3ac3ee528dd17740996659aa1a3eb4143def62041		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6533 11728 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.