Malicious PDF — malware analysis report

Static analysis result for SHA-256 8e6a11501d4cbde5…

MALICIOUS

PDF

39.6 KB Created: 2020-08-29 10:47:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 963989ea571867d2047633b32f1da2cd SHA-1: 0f3c0b1631fa8f8f3080f340c18d6c1d566650dc SHA-256: 8e6a11501d4cbde59b1932a6d59cb5ce83def021cf65d69683068dd80e95e08c
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, with a critical heuristic firing indicating a PDF link farm. One of the primary links points to a known malicious redirector. The document body, though heavily obfuscated, contains the URL 'https://ttraff.ru/wix?keyword=divisiones+de+dos+cifras+pdf', which is flagged as malicious. The presence of numerous links to 'static.usrfiles.com' suggests an attempt to manipulate search engine results or distribute content through a seemingly benign host.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=divisiones+de+dos+cifras+pdf
    • https://static.usrfiles.com/ugd/b8c837_be3b6c19ec5842778bde5634da6edbf4.pdf
    • https://static.usrfiles.com/ugd/b8c837_2415fd677c8c4efca09a2b8bb2eb928c.pdf
    • https://static.usrfiles.com/ugd/b8c837_251f679da47f43389f7377a9b60580d6.pdf
    • https://static.usrfiles.com/ugd/b8c837_e6d1a1a281cd4e11a0b0ea853dca1c83.pdf
    • https://static.usrfiles.com/ugd/b8c837_d1f7a7240fc547119f6dc051bed9310f.pdf
    • https://static.usrfiles.com/ugd/b8c837_a9d43ee10ba949a798850b22f119515a.pdf
    • https://static.usrfiles.com/ugd/b8c837_6d3b184bea27474bb7197d5c0a753128.pdf
    • https://static.usrfiles.com/ugd/b8c837_3a4ea0cd60014030b103700e0c3e7d7e.pdf
    • https://static.usrfiles.com/ugd/b8c837_57a055deee8445489e7134244864cbe1.pdf
    • https://static.usrfiles.com/ugd/b8c837_4367d6e7959444888b34f8d1c335fcca.pdf
    • https://cdn.shopify.com/s/files/1/0435/4496/9367/files/mosufuwike.pdf
    • https://cdn.shopify.com/s/files/1/0431/7796/7776/files/12055806284.pdf
    • https://cdn.shopify.com/s/files/1/0439/4903/1592/files/20740655328.pdf
    • https://cdn.shopify.com/s/files/1/0435/4483/8303/files/temudosusoxe.pdf
    • https://cdn.shopify.com/s/files/1/0431/7826/2689/files/convert_word_to_excel_small.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005ba3.bin
a360791f3a5e11c7825551f82ad796c6e49535bfe4b35711a0fea7425bd8f6f4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5BA3 5176 bytes
font_01_sfnt_off00006d4f.bin
79cb1debbb47e94de3f73f9a8784dc6a60a064b697b3feac6291a6a057bee082		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6D4F 10708 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.