Malicious PDF — malware analysis report

Static analysis result for SHA-256 b31d0fcc5d8172b5…

MALICIOUS

PDF

147.6 KB Created: 2020-09-10 11:21:26 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3bc0c9ede274575ded613ac3bfd35080 SHA-1: 72fdecee0421084760ca761113267df2baa439c6 SHA-256: b31d0fcc5d8172b596ba91f43bacc464d7a906038188a1e1534fb1799c50e637
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a heuristic firing indicating a malicious redirector link. The embedded URL points to 'ttraff.club', which is known to host malicious redirectors. The document body, though heavily obfuscated, contains the same URL, suggesting a social engineering lure to trick users into downloading potentially malicious content. No scripts were extracted from this sample.

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/wix?keyword=jhankar+beats+movie+songs++zip
    • http://fonije.fixfonezfast.com/uploads/1/3/1/0/131071243/vebopediroz-juvolemisoxa.pdf
    • http://lunuviz.junkanddisorderlyaz.com/uploads/1/3/0/8/130814017/jefovikalenin_rutusonizoxum_daler_waxeleje.pdf
    • http://files.downtownwestfieldassociation.com/uploads/1/3/1/4/131408027/1088996.pdf
    • https://cdn.shopify.com/s/files/1/0438/1235/6253/files/dashicons_cheat_sheet.pdf
    • https://cdn.shopify.com/s/files/1/0436/0539/3570/files/33421947159.pdf
    • https://cdn.shopify.com/s/files/1/0430/8847/8359/files/52250638467.pdf
    • https://static.usrfiles.com/ugd/29c71c_d1132f36ba254dde8c1b1cb18f90fa7f.pdf
    • https://static.usrfiles.com/ugd/ac8c68_7b310c87a2c14dbfb49ba0d01fd95658.pdf
    • https://static.usrfiles.com/ugd/756799_2a1bf8443da44e3ea20e3437f4899c85.pdf
    • https://static.usrfiles.com/ugd/ced2dc_bb26099d7f3e4fa19d77f78c67685a8b.pdf
    • https://cdn.shopify.com/s/files/1/0431/5535/7852/files/50156054113.pdf
    • https://cdn.shopify.com/s/files/1/0438/9198/2491/files/clash_of_clans_private_server_2018_apk.pdf
    • https://cdn.shopify.com/s/files/1/0427/9628/6111/files/5072114046.pdf
    • https://cdn.shopify.com/s/files/1/0431/8714/2820/files/99262547748.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001e85f.bin
6acc1559afeff64937f4ff49e0f05e313ae99888359e8e2ca72f46fbf743fbbf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1E85F 2872 bytes
font_01_sfnt_off0001f284.bin
82926043dcbe89c4d13f4c04699a7060ad7352ffb111dc62f67376266e3dfae2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1F284 5292 bytes
font_02_sfnt_off0002045d.bin
b279a18e942bc9b721e53d3e15b128aff96ce50895185464dc7ca76d4272da91		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2045D 14484 bytes
font_03_sfnt_off000231ac.bin
b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x231AC 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.