Malicious PDF — malware analysis report

Static analysis result for SHA-256 8fd2a236b58b881f…

MALICIOUS

PDF

54.4 KB Created: 2020-09-07 19:03:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 92e7ec7103fc684f6aa228fdee25c172 SHA-1: c6775065807b94874a4e9d55e629fe59fa255935 SHA-256: 8fd2a236b58b881fe19a79c2972d0634282cb3d7f45efd21382bafba3f7d50b8
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains multiple heuristics indicating malicious intent, specifically linking to known malicious redirector infrastructure and a large number of external PDF links, suggesting a link farm. The embedded URL and the reconstructed URL from the document body, 'https://ttraff.me/pify?keyword=biotransformation+of+steroids+pdf', are identified as malicious. The document's purpose appears to be to redirect the user to this malicious site.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/pify?keyword=biotransformation+of+steroids+pdf
    • https://static.usrfiles.com/ugd/49488e_f27f3e795e0c4b2daf619bdbb445ac81.pdf
    • https://static.usrfiles.com/ugd/99965f_5bfb3900a4984c7baf77f57ce1d3a9dc.pdf
    • https://static.usrfiles.com/ugd/1d5a3f_ecc6eadc9f394c419d5dddc941164a5f.pdf
    • https://static.usrfiles.com/ugd/0e9fc2_9d9679a6bc834459b87b13368fc2dc30.pdf
    • https://cdn.shopify.com/s/files/1/0434/6295/1062/files/aerobic_and_anaerobic_composting.pdf
    • https://cdn.shopify.com/s/files/1/0437/8152/1569/files/bozopakedosejamiz.pdf
    • https://cdn.shopify.com/s/files/1/0434/4833/6536/files/ley_de_bienestar_animal_guatemala.pdf
    • https://static.usrfiles.com/ugd/a107db_a6b4458d99604d6981caf3f96a4d4e5d.pdf
    • https://static.usrfiles.com/ugd/bbd3cf_aaf774a6b399461aa630b02a51533241.pdf
    • https://static.usrfiles.com/ugd/ecec20_50adc82095354e91893627e4cdc7fb86.pdf
    • https://static.usrfiles.com/ugd/b8c837_b1054495f0e94cb0a6339e3c4811fb71.pdf
    • https://static.usrfiles.com/ugd/90c678_bd33cfe683734e0a94f517720a34b37d.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00009902.bin
f22dfd2bfa7c48522d29c99bb7a9e9121fceef23e9a1f2223cf6ad90c166631d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9902 5204 bytes
font_01_sfnt_off0000aaa2.bin
c65a393a6821f12f8076d2639b016537daaf07122e419440ccbbb8f8c1d42687		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAAA2 10008 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.