Malicious PDF — malware analysis report

Static analysis result for SHA-256 a51caa22b222db4a…

MALICIOUS

PDF

46.6 KB Created: 2020-09-03 00:39:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8c55cce51acdb24461a1c854d27c38a2 SHA-1: 6e5ba0fa4fb93e46043beeb66f3905b023064f7f SHA-256: a51caa22b222db4a3953d187ef09f7c61a005253b7b83a6cda07add63c9ac08b
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links, many of which point to a link farm hosted on static.usrfiles.com. One of the primary links, https://ttraff.club/wix?keyword=android+bitmap+scale+aspect+ratio, is flagged as a malicious redirector. The document body, though heavily obfuscated, contains this same URL, suggesting it is the intended lure. The presence of numerous links and the redirection to a known malicious domain indicate a phishing or scam attempt.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/wix?keyword=android+bitmap+scale+aspect+ratio
    • https://static.usrfiles.com/ugd/d01287_b55a246fe499474f96e4b1ef11431311.pdf
    • https://static.usrfiles.com/ugd/756799_4fe90c2195ee4f46b135e75872e7e36f.pdf
    • https://static.usrfiles.com/ugd/b8c837_897b207d22a14d21aa42d33d431069f8.pdf
    • https://static.usrfiles.com/ugd/ec0012_c1f0a61b08dd45b0973ea9d26300cf47.pdf
    • https://static.usrfiles.com/ugd/0d2fda_25054f067b1944e5a8b79040fd83e859.pdf
    • https://static.usrfiles.com/ugd/3db607_4082442783fc4e5aa1b0a0d766405a56.pdf
    • https://static.usrfiles.com/ugd/e73fea_a16fdd9b046149bb9ee583c1c2ac512f.pdf
    • https://cdn.shopify.com/s/files/1/0437/2915/8295/files/nelimavomorixad.pdf
    • https://cdn.shopify.com/s/files/1/0432/9881/6160/files/all_english_grammar_exercises_with_answers.pdf
    • https://cdn.shopify.com/s/files/1/0433/2909/3784/files/19638719226.pdf
    • https://cdn.shopify.com/s/files/1/0440/5939/4213/files/xisoridoxuzedi.pdf
    • https://static.usrfiles.com/ugd/b8c837_586882f55bae49f7be74bbd8bae9132f.pdf
    • https://static.usrfiles.com/ugd/6924eb_548bf29069c841afb75f25e51f6eb993.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006903.bin
8ccfa67ee16a7ccc03bc35ede35d96d2406436df2028c56c50de09efa2feeb75		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6903 5348 bytes
font_01_sfnt_off00007b11.bin
60c7dd4b349e57b9f531c20cdf26ffd5c271bc9adf192f3177efeea64785ccb1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7B11 15692 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.