Malicious PDF — malware analysis report

Static analysis result for SHA-256 905f0514dc5387fc…

MALICIOUS

PDF

35.6 KB Created: 2020-09-02 00:01:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 90472d3b274391bbe0435c6aa68cdbd0 SHA-1: 9a15a3959c72ac6c700dd3b668cfbb1a79409d15 SHA-256: 905f0514dc5387fcc09cbf9a711416b11f7afee5d4f6559c318a016f9a8822c2
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a link to a known malicious redirector, ttraff.ru, disguised with a keyword related to a bank. This indicates a phishing or malware distribution attempt. The file also contains a large number of embedded links, many pointing to static.usrfiles.com, which is flagged as a link farm. No scripts were extracted, but the presence of the malicious redirector and the link farm heuristic strongly suggest a malicious intent to redirect the user to a harmful site.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=banco+frances+telefonos+sucursal+formosa
    • https://static.usrfiles.com/ugd/81ef4b_e9e4753de0234137ba7a3d4ffc017424.pdf
    • https://static.usrfiles.com/ugd/e02969_b7b5c1435c904a39a18f3d388ca79820.pdf
    • https://static.usrfiles.com/ugd/b8c837_b6b5c9e69a094842918f2183ba34707f.pdf
    • https://static.usrfiles.com/ugd/808d8c_feeb79ee4a04430c9f52baf59fe346a0.pdf
    • https://static.usrfiles.com/ugd/ae15ca_21a1aa43e5684afa846d9fb1e40367bb.pdf
    • https://static.usrfiles.com/ugd/38eac1_b12f8806b5964120ad010cf5c7500da7.pdf
    • https://static.usrfiles.com/ugd/11f207_b9c9d40fd7b64b758a07fcdbe289690d.pdf
    • https://static.usrfiles.com/ugd/5bb01c_11641469f8be4f3fa5cce22562f3f861.pdf
    • https://cdn.shopify.com/s/files/1/0430/1560/2339/files/18793815826.pdf
    • https://cdn.shopify.com/s/files/1/0440/8072/6168/files/annona_squamosa_medicinal_uses.pdf
    • https://cdn.shopify.com/s/files/1/0429/7300/3935/files/62353621877.pdf
    • https://static.usrfiles.com/ugd/0f5b72_17d1ff8b255f4bb8925675492dc3a07b.pdf
    • https://static.usrfiles.com/ugd/24deb6_9ac3ad1a592541488d6836dee66179a4.pdf
    • https://static.usrfiles.com/ugd/0f5b72_0c5d049d93c345f9881f0e7f8edc11ab.pdf
    • https://static.usrfiles.com/ugd/b8c837_4b36690e44f14102b07a6aeeb259cabf.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004e39.bin
95b10c09da8b5018bdb34fb14fa989eda9a3660c9a12c97311826cd72d5ecd1f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4E39 5076 bytes
font_01_sfnt_off00005f69.bin
efbc14d9c5b2f6eca7a90e1981c2a4e3bb822d0cf6d8feba94be367ab202352b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5F69 9912 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.