Malicious PDF — malware analysis report

Static analysis result for SHA-256 b93ec31ead3ee777…

MALICIOUS

PDF

48.5 KB Created: 2020-08-30 15:28:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ee0bae82fc66eaf8343e691aecfe58cc SHA-1: 1a2e4814f2955a0822d385e79288a22452f45cbc SHA-256: b93ec31ead3ee777682a806f0724fda624e8325845dc9e42c61ddbff9ed4eb85
162 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to ttraff.ru. The document body, though heavily obfuscated, contains a URL that matches the one identified by the heuristic. Additionally, the PDF exhibits characteristics of a link farm, with numerous embedded URLs, and a heuristic indicates a lure for remote support tools. These elements suggest the document is designed to trick users into visiting malicious sites, potentially for phishing or scamming purposes.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Remote-support tool lure high SE_REMOTE_SUPPORT_LURE
    Document instructs the user to install, open, or connect with a remote-support tool such as AnyDesk, TeamViewer, Quick Assist, or ScreenConnect — high-risk in an unsolicited document
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=lifestyler+expanse+600+treadmill+weight+limit
    • https://static.usrfiles.com/ugd/704566_7490face56fb473daa23912d31f115a4.pdf
    • https://static.usrfiles.com/ugd/5be868_65c938bc73ad49b188c4d73a8b5ab0a0.pdf
    • https://static.usrfiles.com/ugd/36f25b_05b4333d32dc4630ad04074692fb846c.pdf
    • https://static.usrfiles.com/ugd/c1615c_fba96e5fc07248829c3f304d261b4822.pdf
    • https://static.usrfiles.com/ugd/ae059d_a1b12c8a2409442ca0d6eeadd97efb9e.pdf
    • https://static.usrfiles.com/ugd/0a0016_53ce79d257df48449496a14dfff15cd1.pdf
    • https://static.usrfiles.com/ugd/b8c837_a52c3384528c42f8ad4560c85f05aa5e.pdf
    • https://static.usrfiles.com/ugd/b8c837_2c86a6a768184e918a51f511b9c0e906.pdf
    • https://static.usrfiles.com/ugd/5360f8_74bde3425737458b807a9f37e2028b85.pdf
    • https://static.usrfiles.com/ugd/b8c837_0abcaceee78f4e7dbff6621253b4b752.pdf
    • https://static.usrfiles.com/ugd/b8c837_f23cfcb6d57948f9967fdc9a53116e2b.pdf
    • https://static.usrfiles.com/ugd/a382ee_4af99c74aa9c49a0b093f39297655817.pdf
    • https://static.usrfiles.com/ugd/b8c837_ca90cdc4ee4248cb9a02fae74eff77a1.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007dce.bin
48cbb57ed5ef0eb7be6f8a2bbd7115e0c26aa186117c8d88050e4b61c37c250b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7DCE 5952 bytes
font_01_sfnt_off000091fc.bin
46f9881065ffff9aa4a7c46a2df0b7d6059b888daa277bb964eb7dda900daaad		 pdf-font-stream PDF embedded font (sfnt) at offset 0x91FC 10088 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.