Malicious PDF — malware analysis report

Static analysis result for SHA-256 b9eec4140980bb29…

MALICIOUS

PDF

58.9 KB Created: 2020-08-31 00:40:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8e82bd745d60be8d4a2bbde240adee34 SHA-1: edacbd0b03e2f12a660056f4febbb0534e466339 SHA-256: b9eec4140980bb29e401015c024e0da77c82dbe039534dffbde10225d0afbd87
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a mass of external links, many of which point to a redirector service. One prominent link, 'https://ttraff.ru/wix?keyword=garden+scavenger+hunt', is identified as a malicious redirector. The document also contains a visual download button lure, suggesting a social engineering tactic to entice users to click the malicious link. The presence of numerous PDF links and the redirector strongly indicate a malicious intent to lead users to harmful content.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=garden+scavenger+hunt
    • https://static.usrfiles.com/ugd/ac51ce_c5af30836d9a40ba8a803b3660c0821b.pdf
    • https://static.usrfiles.com/ugd/37321e_6f366572a54c41c99150cf13cba58473.pdf
    • https://static.usrfiles.com/ugd/b8c837_a4828b92555b41358da5203a94787f42.pdf
    • https://static.usrfiles.com/ugd/b8c837_3a53140c68e54a268f467692d0803f34.pdf
    • https://static.usrfiles.com/ugd/5bb01c_437d3168ba5a41739374a465dc3c52f6.pdf
    • https://cdn.shopify.com/s/files/1/0461/4268/5337/files/45838996981.pdf
    • https://cdn.shopify.com/s/files/1/0430/6118/2617/files/38780058754.pdf
    • https://cdn.shopify.com/s/files/1/0432/9196/7652/files/sugosudafakeriwabunumite.pdf
    • https://cdn.shopify.com/s/files/1/0438/6865/1680/files/24576420089.pdf
    • https://cdn.shopify.com/s/files/1/0431/0948/2658/files/tavarezekibobotusan.pdf
    • https://static.usrfiles.com/ugd/ce14f3_f616352db22445b0b8d7fd0f27d8b568.pdf
    • https://static.usrfiles.com/ugd/77941b_8f8586c8f6a0451da47886fcf865164f.pdf
    • https://cdn.shopify.com/s/files/1/0435/8435/6509/files/autonomy_meaning.pdf
    • https://cdn.shopify.com/s/files/1/0432/4609/2443/files/sample_employment_verification_letter.pdf
    • https://cdn.shopify.com/s/files/1/0433/1444/6489/files/tevor.pdf
    • https://cdn.shopify.com/s/files/1/0434/5469/3529/files/wagiteno.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006ddc.bin
f0b439f4b6e197365693d0fff73563b79acc7b79372616f60076d519f6e37940		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6DDC 5260 bytes
font_01_sfnt_off00007fbe.bin
475b454196a912fc6742b94c0019ef23fded76e723cfcd0ceb6d8301a46ec7ab		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7FBE 10236 bytes
font_02_sfnt_off0000a1f9.bin
291726618500a780cae435391d8114aca051ab362573325bda29d810151387ef		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA1F9 11356 bytes
font_03_sfnt_off0000c88f.bin
68fb388c6b89fa332810f41b5bb86928254c5d182ee1207b277fc27fe5f5d1eb		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC88F 16328 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.