Malicious PDF — malware analysis report

Static analysis result for SHA-256 a39528637d3ba6ae…

MALICIOUS

PDF

42.9 KB Created: 2020-08-29 03:29:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5b48fc5260b062432fc893a44eb7b18d SHA-1: b528bc052edb26bf1023ecfe43d69fbe28b75a57 SHA-256: a39528637d3ba6ae41228646069f3e6d0a42766af69ac1ea018156fc9264b7aa
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a heuristic firing for a malicious redirector link, specifically pointing to 'https://ttraff.cc/wix?keyword=zoids+battle+legends+psp'. This indicates an attempt to redirect the user to a malicious site. The document body also contains this URL, reinforcing the malicious intent. The presence of numerous external PDF links, many hosted on static.usrfiles.com, suggests a link farm or SEO poisoning tactic to distribute the malicious redirector.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=zoids+battle+legends+psp
    • https://static.usrfiles.com/ugd/b8c837_558be57c9b444ec29405b26a0a826d00.pdf
    • https://static.usrfiles.com/ugd/b8c837_97ae035b272045479be49a6e15ce87e1.pdf
    • https://static.usrfiles.com/ugd/b8c837_ab7e646ad1c64a66bb9fcb67025c7c7a.pdf
    • https://static.usrfiles.com/ugd/b8c837_d49e548761f04ac7bab9f093532df1fe.pdf
    • https://static.usrfiles.com/ugd/b8c837_0575b038a9734f3d914b65e489cd4a48.pdf
    • https://static.usrfiles.com/ugd/b8c837_a234725131204072be73204f96052323.pdf
    • https://cdn.shopify.com/s/files/1/0435/4487/1063/files/9apps_whatsapp_free.pdf
    • https://cdn.shopify.com/s/files/1/0434/6318/0438/files/kefarizudadekadasoluj.pdf
    • https://static.usrfiles.com/ugd/b8c837_9d79766ea59e435690ebf10c9d49a377.pdf
    • https://static.usrfiles.com/ugd/b8c837_6019ff8e958f41e58820a011ac57f7fc.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005804.bin
1f21f7056b2621fa7980b8256fd568451aaa71d9319b164de2317079e9c0dd6d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5804 4880 bytes
font_01_sfnt_off00006905.bin
43a2f336fba6cd083e78c076ae98a7e8c725af2350ed48186e645789fb08f619		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6905 5128 bytes
font_02_sfnt_off00007a8a.bin
4ab9627943ff72fd4176d4f4c34cbef2bb3c68fcf728d886c197e591a56da783		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7A8A 10176 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.