Malicious PDF — malware analysis report

Static analysis result for SHA-256 8cb5adf7d044dcef…

MALICIOUS

PDF

115.2 KB Created: 2020-08-30 01:33:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 861875c49598d60307864821aabb96b3 SHA-1: 21429b59b8059ae5aeda883f14f99a6a83b95119 SHA-256: 8cb5adf7d044dcef651332b4b53bd768e038fafd1b6d9e4b089f23c17fd10f66
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a link to a known malicious redirector, ttraff.com, which is disguised with a Star Wars-related keyword. This indicates a phishing or social engineering attempt to redirect the user to a malicious site. The file also contains a large number of links to static.usrfiles.com, suggesting a link farm or SEO poisoning tactic to improve search engine ranking for malicious content. No scripts were extracted from this sample.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=star+wars+the+clone+wars+seasons
    • https://static.usrfiles.com/ugd/b8c837_bce09e6929ee4223b55d3ecf40c1e01b.pdf
    • https://static.usrfiles.com/ugd/b8c837_25ac3e0f25bb42f1a1fc6501181d2e5f.pdf
    • https://static.usrfiles.com/ugd/b8c837_e10ee5f6e76d49589f79dae644af953f.pdf
    • https://static.usrfiles.com/ugd/b8c837_8147e87ba11b4a05a5b9d75ba534a127.pdf
    • https://static.usrfiles.com/ugd/26938b_d760f0a89c5f449b903bd9d3c3d6ad8e.pdf
    • https://static.usrfiles.com/ugd/b8c837_ddb5693a4e1948ef990733007f7e0f32.pdf
    • https://static.usrfiles.com/ugd/b8c837_667933dfe85642a585d3573aa8fc227a.pdf
    • https://static.usrfiles.com/ugd/7f16bd_f2277d1f06714784a3cc5092e93f7b77.pdf
    • https://static.usrfiles.com/ugd/b8c837_f7a807859dc34f56aad9b7afb7e94efb.pdf
    • https://static.usrfiles.com/ugd/b8c837_010d7a20908c40c0b5541ef180ae64c3.pdf
    • https://static.usrfiles.com/ugd/b8c837_5534b1fd798b4bd2ab91d8ec39330eb0.pdf
    • https://static.usrfiles.com/ugd/b8c837_f09e7c95316f4fa48aca75a811768719.pdf
    • https://static.usrfiles.com/ugd/0047a4_5c84cf6fd17e4a75b9efc7d505ad1401.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00018804.bin
b62d3f8758ff9a548fd35105478f95019c4eea2b5b79e6aded596ea51bc7aa51		 pdf-font-stream PDF embedded font (sfnt) at offset 0x18804 5080 bytes
font_01_sfnt_off00019946.bin
025bf68f4c02a8e949948468d1fb126cf9a3fc1e7957ef8849c5365c36c21fc6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x19946 11252 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.