Malicious PDF — malware analysis report

Static analysis result for SHA-256 b3ddbd6b9cd5d7b8…

MALICIOUS

PDF

41.3 KB Created: 2020-08-30 17:04:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5ca6106d9b1dae8d80cd6ef5b0c515f7 SHA-1: cd3ff768a553a40c3647dffd6ac77583f0f1f963 SHA-256: b3ddbd6b9cd5d7b89cb4eadf0ace7e185d272ef3136f214db1dbd0f6a9a58f97
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links, identified as a PDF link farm. One of these links, 'https://ttraff.com/wix?keyword=goals+for+apraxia+of+speech+in+adults', is flagged as a malicious redirector. The document body, though partially corrupted, contains text related to the topic of the malicious URL, suggesting a lure. The presence of numerous links to static.usrfiles.com indicates a coordinated effort to host many related documents.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=goals+for+apraxia+of+speech+in+adults
    • https://static.usrfiles.com/ugd/b8c837_0fd8446f6b5847ea8399067fa84bd8c4.pdf
    • https://static.usrfiles.com/ugd/2813e2_4a3d53dac7664c88b2b090180e9e58cf.pdf
    • https://static.usrfiles.com/ugd/b8c837_0b85067cdeb548399a006cf4caf3c6a1.pdf
    • https://static.usrfiles.com/ugd/cac9e4_f3efae93d9b14899a5ba52d0d69aa010.pdf
    • https://static.usrfiles.com/ugd/c068f8_297b8602fac34d95bb25c3356d48cf9e.pdf
    • https://static.usrfiles.com/ugd/a43ec6_af11cf9ff5044a3c825525625751515d.pdf
    • https://static.usrfiles.com/ugd/b8c837_da597b5dc8d14027ba045ec08f63c16b.pdf
    • https://static.usrfiles.com/ugd/04e6f9_355aa8343dee49e486295bcb143ea876.pdf
    • https://cdn.shopify.com/s/files/1/0464/7357/6616/files/karezemenegakigup.pdf
    • https://cdn.shopify.com/s/files/1/0449/0277/6999/files/libros_de_arquitectura_bioclimatica.pdf
    • https://cdn.shopify.com/s/files/1/0435/3599/0943/files/axel_fischer_amsterdam.pdf
    • https://static.usrfiles.com/ugd/b8c837_786f21961f584894a3c225790d04a6a3.pdf
    • https://static.usrfiles.com/ugd/6290de_11c4da7f646f4099b19221f5c5bec146.pdf
    • https://static.usrfiles.com/ugd/b8c837_955a13aea1074fa1b367fd6c49cbe768.pdf
    • https://static.usrfiles.com/ugd/e3325f_9bda1c95e4fd4be9855e2b88ebb304cc.pdf
    • https://static.usrfiles.com/ugd/01e791_29c1c2300523432f84b318aa890c0407.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006435.bin
a40df9a0bddec2a2633e4e5e0bb1f86e8038b5f12847164850dc00d1c5d77775		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6435 5344 bytes
font_01_sfnt_off0000765c.bin
8917c25e3917888ee2f8e7351983b74277795e353d306e45831b295bdc0ef368		 pdf-font-stream PDF embedded font (sfnt) at offset 0x765C 10272 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.