Malicious PDF — malware analysis report

Static analysis result for SHA-256 9a298a22e6cde91f…

MALICIOUS

PDF

50.1 KB Created: 2020-08-30 17:02:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 93c173ae18f81c691e3e08a68a2ff88a SHA-1: 48dee20f0fd4f7fbfb4f9dbd38f842e4c73593a3 SHA-256: 9a298a22e6cde91faa0becdf53cddd22119f3927c6cd3cc3e7316acfff895291
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a heuristic firing for a malicious redirector link, specifically pointing to 'https://ttraff.cc/wix?keyword=frc+2019+update+suite+serial+number'. This URL is presented within the document body, suggesting a social engineering attempt to trick the user into clicking it. The document also contains a large number of embedded links to PDFs hosted on 'static.usrfiles.com', indicating a potential link farm or distribution mechanism.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=frc+2019+update+suite+serial+number
    • https://static.usrfiles.com/ugd/ae15ca_ad6de90af34249268f71d9d61916d69a.pdf
    • https://static.usrfiles.com/ugd/b8c837_d5dd5b56f6ec452c817aecb991107b83.pdf
    • https://static.usrfiles.com/ugd/cd79e3_360cb89fab20401c9edacf9ec7c360c8.pdf
    • https://static.usrfiles.com/ugd/b65acf_153257880b1d4948b340b064cb06ff9d.pdf
    • https://static.usrfiles.com/ugd/5be868_b6109c7afa8a49ffbf694bbd31083d37.pdf
    • https://static.usrfiles.com/ugd/64d889_d207e861ab0f43c98ccf04e3d1966968.pdf
    • https://static.usrfiles.com/ugd/ae059d_a453fd8812dc4f43bf0539c4f8c999cb.pdf
    • https://static.usrfiles.com/ugd/b8c837_4d0dcc6942254291ad08b1dd63b43c85.pdf
    • https://static.usrfiles.com/ugd/760101_cdb75f040ef04a6cbafb5e214d4e34c3.pdf
    • https://cdn.shopify.com/s/files/1/0431/6423/7988/files/partitioning_a_segment_worksheet_answer_key.pdf
    • https://cdn.shopify.com/s/files/1/0441/0913/6024/files/37804625329.pdf
    • https://cdn.shopify.com/s/files/1/0430/4276/7001/files/37056168531.pdf
    • https://cdn.shopify.com/s/files/1/0437/4682/0245/files/8593208321.pdf
    • https://cdn.shopify.com/s/files/1/0437/2597/9797/files/bulajimiwosuvitaraguwi.pdf
    • https://cdn.shopify.com/s/files/1/0440/1653/3654/files/busy_works_beats_chord_codes.pdf
    • https://cdn.shopify.com/s/files/1/0437/3417/1813/files/download_tomb_of_annihilation.pdf
    • https://cdn.shopify.com/s/files/1/0438/1625/5650/files/14446841451.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000075d9.bin
a8bdf1762340a25b2daa99e75a7415150bb18d6e63394c1508875efe258b10a2
pdf-font-stream PDF embedded font (sfnt) at offset 0x75D9 5568 bytes
font_01_sfnt_off0000889b.bin
38c683c420de91e9cda431c4cea7b20859fc41a5584b76b133c55822eec59cfd
pdf-font-stream PDF embedded font (sfnt) at offset 0x889B 10740 bytes
font_02_sfnt_off0000ad34.bin
7f6049e5011acf0e8581793f2bc2bb947aac2929fdb77abc318b2a6155c1ef71
pdf-font-stream PDF embedded font (sfnt) at offset 0xAD34 4324 bytes