Malicious PDF — malware analysis report

Static analysis result for SHA-256 98b1f1e0d0acc6fa…

MALICIOUS

PDF

68.1 KB Created: 2020-09-04 05:57:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 890d37ed13a12bc5047fb593fe65faa9 SHA-1: 64383aa3ecacda197a285d45a622b120934c6262 SHA-256: 98b1f1e0d0acc6fac869736464cefac9200f2c0ae67d735fc07c6387972ba0d4
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a critical heuristic firing for a malicious redirector link, pointing to 'ttraff.club'. This indicates the document's primary purpose is to lure users to a potentially harmful external site. The document body is heavily obfuscated and appears to be generated content, further supporting a malicious intent rather than legitimate document sharing. No scripts were extracted, but the presence of the malicious URL is a strong indicator of a phishing or malware delivery attempt.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/wix?keyword=sheeting+excavation+%25E4%25B8%25AD%25E6%2596%2587
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/51851907441.pdf
    • https://cdn.shopify.com/s/files/1/0431/2596/4949/files/80175138309.pdf
    • https://cdn.shopify.com/s/files/1/0433/9272/9246/files/anemia_perniciosa_scielo.pdf
    • https://static.usrfiles.com/ugd/e32576_a702a4067a7043da98dbc530cb9a6d90.pdf
    • https://static.usrfiles.com/ugd/f390e7_7be7a22b0b444082b98e293706e066a2.pdf
    • https://static.usrfiles.com/ugd/7e6083_11c892570e464af39c1ff6cf76f51345.pdf
    • https://static.usrfiles.com/ugd/8ff694_5229803c694442c3801acb028840fbe5.pdf
    • https://static.usrfiles.com/ugd/b8c837_292e57e6f54449f19591ea43a18221a3.pdf
    • https://static.usrfiles.com/ugd/b8c837_beca9e4ba94f44a2b7e5625795313e4e.pdf
    • https://static.usrfiles.com/ugd/02beb7_03a277ac6daa41afacddefb541f98041.pdf
    • https://static.usrfiles.com/ugd/9e53d4_c87b88f742f94c168c20e30e18e06135.pdf
    • https://static.usrfiles.com/ugd/b8c837_b7ff14640d1e4521a3cc30bfe1034d25.pdf
    • https://static.usrfiles.com/ugd/e6092c_7d9d06db7be4483b982361e3102da5d2.pdf
    • https://static.usrfiles.com/ugd/83b1b3_46801d345c6445569b317920bc2357b6.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000092e8.bin
1c69a704548355bf27ecb74f8a705662fd0d8347fad32edc50cadd462ec95ea7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x92E8 3660 bytes
font_01_sfnt_off00009fa5.bin
1d91dc015e5f35b51cb2fd9920352be6dd5765c2aaf29a0402befc798b42a57d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9FA5 3112 bytes
font_02_sfnt_off0000aaab.bin
eda962d92514c2122433525bce9a04565ff88be4a96b40505af6cd918959a6dd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAAAB 4988 bytes
font_03_sfnt_off0000bbb8.bin
61fd0da1484e5c68fb7946c766f428f93354f82529543917ee085260317fe53d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xBBB8 14992 bytes
font_04_sfnt_off0000ead8.bin
cf96631f784379724622ae63351c9d35a5a19c08ac2d66cb149eb318896b45b9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEAD8 16416 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.