Malicious PDF — malware analysis report

Static analysis result for SHA-256 9428f9c941b70867…

MALICIOUS

PDF

50.1 KB Created: 2020-08-31 11:26:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 785e52ac4d9f7d2bd057640d75fedbd6 SHA-1: f3ee7ca191f3e273df7b971ee476a42d605e85a5 SHA-256: 9428f9c941b708670646cf7aba8f0a38fe0c0353c5e4198601fae7ea88399163
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF contains a mass external link farm and a specific malicious redirector link, indicating a social engineering attempt to trick the user into clicking. The heuristic 'SE_BROWSER_INSTALL_LURE' confirms the document's intent to deceive the user into installing something or visiting a link to view content. The primary malicious URL identified is ttraff.cc, which redirects to a page related to 'naruto shippuden opening 3 blue bird'.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=naruto+shippuden+opening+3+blue+bird
    • https://static.usrfiles.com/ugd/71fd01_f2125258d78b44aa94f160bc3507b719.pdf
    • https://static.usrfiles.com/ugd/b8c837_69260b6ea10e4c69897655aa39b009b2.pdf
    • https://static.usrfiles.com/ugd/de60da_cffa64aa3d5b407b90921b3812f3f802.pdf
    • https://cdn.shopify.com/s/files/1/0439/7400/0798/files/batezibufux.pdf
    • https://cdn.shopify.com/s/files/1/0429/4891/9450/files/35657625948.pdf
    • https://cdn.shopify.com/s/files/1/0432/1450/4093/files/41205127896.pdf
    • https://cdn.shopify.com/s/files/1/0437/5409/4753/files/permutations_vs_combinations_worksheet_answers.pdf
    • https://cdn.shopify.com/s/files/1/0434/8814/9654/files/chirosports_performance_rehab.pdf
    • https://static.usrfiles.com/ugd/b8c837_5f5df364077b4c2c9bb7c1e71aeafdba.pdf
    • https://static.usrfiles.com/ugd/7603ae_971c76789bd841d1872abede087a06a0.pdf
    • https://static.usrfiles.com/ugd/98857b_23242d04a8cf436b9d72f41dc6041b41.pdf
    • https://static.usrfiles.com/ugd/7c30af_237c1f1bf7644913813eb671509ef1b7.pdf
    • https://static.usrfiles.com/ugd/79cb75_a4a961227d0846dba2cb7ff20d593e16.pdf
    • https://static.usrfiles.com/ugd/af0aa9_4c40ac4baec14fcabccebcf2eefb2365.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006568.bin
f5d97f4c8bcf6f47111bc61430422f6ebe6956735c36157bb6675a41a16f9343
pdf-font-stream PDF embedded font (sfnt) at offset 0x6568 9556 bytes
font_01_sfnt_off0000859f.bin
1d4cfa129b4b3a6f7b97843f7ae7bf86409995bec8d86ff4eb92955f4cc39b0e
pdf-font-stream PDF embedded font (sfnt) at offset 0x859F 5496 bytes
font_02_sfnt_off0000983c.bin
a563a418c076be50154191da9fcbf61902d28a0a116bc53eee865a84c88300e1
pdf-font-stream PDF embedded font (sfnt) at offset 0x983C 10080 bytes