Malicious PDF — malware analysis report

Static analysis result for SHA-256 aa3ccf9439f75fb6…

MALICIOUS

PDF

75.0 KB Created: 2020-09-17 15:38:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 59a17dd4f9fe162fba0b3d634b48bf07 SHA-1: cdce8ef016057000d7cd744a5843d4e76df83454 SHA-256: aa3ccf9439f75fb65dd4977f9f1866f21a7c0f1807f23819cb33dd9de27871ef
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a critical heuristic firing for a malicious redirector link, which is also present in the document body. The file also exhibits characteristics of a link farm, with numerous external PDF links. The primary malicious URL identified is https://ttraff.link/wix?keyword=anglo+saxon+weapons+and+armor, which likely serves as a lure to a malicious site.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/wix?keyword=anglo+saxon+weapons+and+armor
    • http://files.invetr.com/uploads/1/3/1/4/131406086/jupodowi_kesivevemosate_rejuf.pdf
    • http://rululiwi.t1decals.com/uploads/1/3/1/3/131383483/zebob-virabas-nodumarota-gurazobuj.pdf
    • http://files.whitneyhorrocksfineart.com/uploads/1/3/1/6/131606261/b2a59a14c575.pdf
    • http://files.heleneathanasiadis.com/uploads/1/3/2/7/132710700/redozaman.pdf
    • http://files.clean-lineblacktop.com/uploads/1/3/1/6/131606268/0bd373c.pdf
    • http://files.olitan.com/uploads/1/3/1/3/131380263/5774409.pdf
    • https://cdn.shopify.com/s/files/1/0431/4942/6839/files/puvanevis.pdf
    • https://cdn.shopify.com/s/files/1/0434/6845/6088/files/bodak_yellow_mp4_audio.pdf
    • https://cdn.shopify.com/s/files/1/0434/6268/8918/files/jowonikox.pdf
    • https://c3425825-b9dd-45dc-af39-0af451979009.filesusr.com/ugd/8e6e76_1522ba6d71c24876826e75e2d76f629d.pdf?index=true
    • https://80c0fb97-ba10-4e2b-b3fe-24c5554f4962.filesusr.com/ugd/33a2e4_c81487dcbde0457db11abb8f96dc22a5.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d1d7.bin
52370367755a82568b9b7bb6d513cc67d120c07440c0062ce39e0b0c2de14a13		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD1D7 5428 bytes
font_01_sfnt_off0000e454.bin
d5a2b77f19f692f27afa8ce1752e810a852e2d886ee1d37cf3c555dadb406cd2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE454 10756 bytes
font_02_sfnt_off00010957.bin
32da444a9c28c80d3cba7317d8be5e3878555868ac5b9cce42ec85ac98056110		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10957 16168 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.