Malicious PDF — malware analysis report

Static analysis result for SHA-256 a2019794eb7276f6…

MALICIOUS

PDF

46.6 KB Created: 2020-09-01 01:08:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 656c7c308ed6c069b2c7335355a5651c SHA-1: 08132f48e43030c84a6187cf09a79b654c5fcd9a SHA-256: a2019794eb7276f643a444f66554b7e5f564941f8b4f0e6a255e1fbe46d50c55
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a link to a redirector URL, ttraff.com, which is associated with malicious activity. The document body, though heavily obfuscated, contains text fragments suggesting a lure related to 'a gentleman full movie moviescounter'. The presence of numerous external PDF links, many pointing to static.usrfiles.com, indicates a link farm designed to attract traffic. The primary malicious IOC is the redirector URL.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=a+gentleman+full+movie++moviescounter
    • https://static.usrfiles.com/ugd/7603ae_f7d73bb1379141849b63b00e1120d69a.pdf
    • https://static.usrfiles.com/ugd/e2b09b_e4e13fc4c04c40b181c80e8198d3bdb8.pdf
    • https://static.usrfiles.com/ugd/96bf9d_c334680f8f014451bcbe33b2af60cae2.pdf
    • https://static.usrfiles.com/ugd/3aee12_f8f66a470cde4c779127fec820f15a7b.pdf
    • https://static.usrfiles.com/ugd/b8c837_96d04563b91e43d4904875a785eaa00c.pdf
    • https://static.usrfiles.com/ugd/b8c837_10dcad269aaf4e1997d93c39984a6ab3.pdf
    • https://static.usrfiles.com/ugd/1df9ea_553cc90077c44459a2a22bc57f6e2047.pdf
    • https://static.usrfiles.com/ugd/ef253e_baeed0d2d7a04e7bae73c9562b554b82.pdf
    • https://cdn.shopify.com/s/files/1/0432/9275/4076/files/software_conceptual_design_document_template.pdf
    • https://cdn.shopify.com/s/files/1/0438/1822/1730/files/solving_compound_and_absolute_value_inequalities.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/xazijejizamoketabuguta.pdf
    • https://cdn.shopify.com/s/files/1/0435/9074/6271/files/carnegie_learning_inc_answers.pdf
    • https://cdn.shopify.com/s/files/1/0428/3210/1543/files/jefudamidunawuna.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000621a.bin
952df3e177176109378d36b17eb998d3e837e4e43b99ef7bc2e5c1a4f6efa5c0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x621A 5248 bytes
font_01_sfnt_off000073f0.bin
aa9ceeff9c180aa62b9a658ccda6a655347bfe30557cde0216b8dfb6001bc5f0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x73F0 10520 bytes
font_02_sfnt_off00009841.bin
c41fc46809d2260d2d1a821cef6bb00dae560fdbad380da94a93f29d012df54e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9841 16164 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.