Malicious PDF — malware analysis report

Static analysis result for SHA-256 9f86ddd0bc82c0eb…

MALICIOUS

PDF

47.9 KB Created: 2020-09-01 15:23:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9608d919f3f47834fdb27ef76de6327d SHA-1: 78ae599aa7ed4ec6c105aa4c91ea86b91e75a898 SHA-256: 9f86ddd0bc82c0eb87ebcfdfd4d100e98f4841e3c5378fd2d1099e8668dde0ca
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a link to a known malicious redirector, ttraff.ru, which is disguised with a keyword related to 'mobile movies 2019'. The document body also contains this URL and numerous other links to static.usrfiles.com, indicating a link farm or redirection strategy. The primary attack pattern is social engineering through a deceptive link.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=mobile+movies+2019
    • https://static.usrfiles.com/ugd/b8c837_24e161106c194280bc354221f0f6fc7c.pdf
    • https://static.usrfiles.com/ugd/f09a9d_3f19e70a6e8347128b9c7a343ca4cbe2.pdf
    • https://static.usrfiles.com/ugd/2e16aa_dcca84e3e58b46f288eb42c176c134d7.pdf
    • https://static.usrfiles.com/ugd/b8c837_07f1833272384d079acb5395a7a114ed.pdf
    • https://static.usrfiles.com/ugd/121e37_58c82cb5b54d4c319abe91224b0365b5.pdf
    • https://static.usrfiles.com/ugd/9b5f63_81e4fbd5b6194dcd980aed94ad15e9f7.pdf
    • https://static.usrfiles.com/ugd/9219f8_3ee564d5c078402fb16e56b5ba94e3fd.pdf
    • https://static.usrfiles.com/ugd/6f9b04_c4ee052578dc40c1a51786ea444f8e19.pdf
    • https://static.usrfiles.com/ugd/b52961_fde6cd2987044d3ead9a664c29c885e2.pdf
    • https://cdn.shopify.com/s/files/1/0445/5114/3588/files/albania_country_profile.pdf
    • https://cdn.shopify.com/s/files/1/0429/6137/1290/files/62013974220.pdf
    • https://cdn.shopify.com/s/files/1/0433/9105/8076/files/muwoxusigivawemixetab.pdf
    • https://cdn.shopify.com/s/files/1/0433/9177/8965/files/70932823181.pdf
    • https://cdn.shopify.com/s/files/1/0432/6345/9486/files/15081802496.pdf
    • https://cdn.shopify.com/s/files/1/0440/1351/9006/files/magento_stack_exchange.pdf
    • https://cdn.shopify.com/s/files/1/0430/3601/6802/files/calcination_definition.pdf
    • https://cdn.shopify.com/s/files/1/0430/3749/1357/files/cryptography_free.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007ce0.bin
cf1b8f6812fc8dc53079b036c985930122273bb94eaac980d7eb31519299def4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7CE0 5212 bytes
font_01_sfnt_off00008ea5.bin
f5b511b04cc50d0e5b2ac72827a4aaec0adbe1bb51b7310879580d5b285c381c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8EA5 10476 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.