Malicious PDF — malware analysis report

Static analysis result for SHA-256 ae5d59dd3fd99e17…

MALICIOUS

PDF

48.3 KB Created: 2020-09-06 01:10:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 63da74525d3a10c73555fe8b38466f21 SHA-1: 0708999ba454cb14e7a789c06714fbe78d6f350d SHA-256: ae5d59dd3fd99e1720183a434a3410d0ee793d93fa5c9241a9eca4180187b63a
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.me/wix?keyword=aminoglucosidos+espectro+pdf'. Additionally, it exhibits a PDF link farm heuristic, indicating a large number of embedded external PDF links, with 'https://static.usrfiles.com/ugd/73cb9e_6e1b0de2858848b783e0b33b527f3234.pdf' being the first identified. The document body, though heavily obfuscated, contains these URLs, suggesting the primary intent is to drive traffic to potentially malicious or SEO-manipulated content.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=aminoglucosidos+espectro+pdf
    • https://static.usrfiles.com/ugd/73cb9e_6e1b0de2858848b783e0b33b527f3234.pdf
    • https://static.usrfiles.com/ugd/e3834b_c256e4faa626470f97fef653e7d08c47.pdf
    • https://static.usrfiles.com/ugd/b8c837_fd0d0913464c447e8d33514485477726.pdf
    • https://static.usrfiles.com/ugd/3e9e83_238a3758c627489989dedc89586d03c0.pdf
    • https://static.usrfiles.com/ugd/ab922d_1b94e6d11fb34a559c8fc184ea6bb6d5.pdf
    • https://static.usrfiles.com/ugd/4b7290_0802e4797e89429cb284a39f46727e95.pdf
    • https://static.usrfiles.com/ugd/760a88_2affa12cc3cb46a98b676f075a1fd1f9.pdf
    • https://static.usrfiles.com/ugd/d9d1f5_81cad675b6ea4e14921b74b8023e2e30.pdf
    • https://static.usrfiles.com/ugd/7baf93_44e87a5d41d24d0bb8ee6e9ec830f301.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/7082322425.pdf
    • https://cdn.shopify.com/s/files/1/0430/9542/5191/files/all_star_superman_comic.pdf
    • https://cdn.shopify.com/s/files/1/0433/1939/4462/files/chromium_browser_free.pdf
    • https://cdn.shopify.com/s/files/1/0434/8716/6628/files/94491000963.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007ffc.bin
6639649b873a350c711bd00ed41e490d3ccf48e8591f0dd1295994161e0dfdf7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7FFC 5252 bytes
font_01_sfnt_off000091ce.bin
dc9c0c191289d84a1c33b3803473bfef08edd439df4e6732fbe93304f1d2a664		 pdf-font-stream PDF embedded font (sfnt) at offset 0x91CE 10060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.