Malicious PDF — malware analysis report

Static analysis result for SHA-256 94a6fec8541b9a74…

MALICIOUS

PDF

40.8 KB Created: 2020-08-29 20:11:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4741cb09c3421153aed1a7cee56f77a1 SHA-1: 434d6af052fc86fc5ea00c656cfbb8930d5861d3 SHA-256: 94a6fec8541b9a748dea24d023e1aaace807cb12995c1275414229beec547f2c
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a critical heuristic firing for a malicious redirector link pointing to ttraff.com, which is used in a lure for a "never back down full movie download". The document body also contains this URL and a benign-looking PDF URL from static.usrfiles.com, likely part of a link farm. The primary malicious indicator is the redirector link, suggesting a phishing or social engineering attack.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=never+back+down+full+movie+download
    • https://static.us
    • https://static.usrfiles.com/ugd/b8c837_d008720e64f5469e906359ab5684feeb.pdf
    • https://static.usrfiles.com/ugd/b8c837_3812a23079d74b67bbe662700c4bc0bd.pdf
    • https://static.usrfiles.com/ugd/b8c837_12c70df8f6874c928cbe2bf06766e928.pdf
    • https://static.usrfiles.com/ugd/b8c837_3ee1cf382a9e47acaf634a3dbb58835d.pdf
    • https://static.usrfiles.com/ugd/913720_79f2f38cffec4e0dac84182f64d2f198.pdf
    • https://static.usrfiles.com/ugd/b8c837_5c352813e7f442fdb1ed34f6eb341faa.pdf
    • https://static.usrfiles.com/ugd/b8c837_b9a11ba2a6934f87a27d202fa4456817.pdf
    • https://static.usrfiles.com/ugd/b8c837_929210451409494dafa5fd2e9e4a2dc6.pdf
    • https://static.usrfiles.com/ugd/b8c837_d99d9feb1f144681b9db795ef12f9348.pdf
    • https://static.usrfiles.com/ugd/e5cbe5_363b8c85cb024f548be777b92a6fae65.pdf
    • https://cdn.shopify.com/s/files/1/0457/7371/7670/files/checks_and_balances_chart_worksheet_answers.pdf
    • https://cdn.shopify.com/s/files/1/0431/0378/1015/files/dexawawiwimunoxifomapa.pdf
    • https://cdn.shopify.com/s/files/1/0446/6376/7203/files/10017354175.pdf
    • https://cdn.shopify.com/s/files/1/0430/4420/8789/files/history_of_islamic_empire_in_urdu.pdf
    • https://cdn.shopify.com/s/files/1/0435/9982/3016/files/virozujikotoxoluket.pdf
    • https://cdn.shopify.com/s/files/1/0432/5123/7022/files/zununeguxog.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005f00.bin
25ed3b6980d381b088e75f5c5b030edc0d9a0c7c97af8295d4871fd1a44675d1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5F00 5312 bytes
font_01_sfnt_off00007116.bin
f73f12e35b959c0293d5d565d340efccfc163f5c0be12ff0113b3b26f4c880c1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7116 10860 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.