Malicious PDF — malware analysis report

Static analysis result for SHA-256 ba5892eb758e16df…

MALICIOUS

PDF

58.2 KB Created: 2020-08-31 12:20:24 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5c6ea8e6d698f54721fe0597d7e67601 SHA-1: 3ecf4258f99c6b99b53490880e3f9f4b02ff4200 SHA-256: ba5892eb758e16df111776f36c2f92dc340605b9abc22b32ad1085ce1a803362
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.cc/wix?keyword=quien+invento+el+mambo+cuento+completo'. Additionally, it exhibits characteristics of a PDF link farm, with numerous embedded links, many pointing to 'static.usrfiles.com'. The document body, though partially corrupted, includes the same malicious URL and several benign-looking PDF links, suggesting a social engineering attempt to direct users to malicious infrastructure. No scripts were extracted from this sample.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=quien+invento+el+mambo+cuento+completo
    • https://static.usrfiles.com/ugd/b8c837_a15df89d11d04cac9da1fcf2f28cd735.pdf
    • https://static.usrfiles.com/ugd/99965f_690b4f39d4254690b1ab867dcab7b485.pdf
    • https://static.usrfiles.com/ugd/b8c837_62ac221ab0b6499bbd06ebe1da90573b.pdf
    • https://static.usrfiles.com/ugd/865d50_4f78219c4762491d8878f7d3bd92f28c.pdf
    • https://static.usrfiles.com/ugd/12745a_a992e41e6439423888297ba30d0914f7.pdf
    • https://static.usrfiles.com/ugd/b8c837_b9464c5a347c4eaf88625084b4a2eb7a.pdf
    • https://cdn.shopify.com/s/files/1/0431/3484/5079/files/zelibagefakevufexipik.pdf
    • https://cdn.shopify.com/s/files/1/0433/8027/7406/files/bekhayali_lyrics_english.pdf
    • https://cdn.shopify.com/s/files/1/0434/4302/8120/files/19337349336.pdf
    • https://cdn.shopify.com/s/files/1/0430/7487/9641/files/poe_diamond_flask.pdf
    • https://cdn.shopify.com/s/files/1/0434/8008/8742/files/aetna_better_health_ky_reconsideration_form.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008094.bin
121e6d3c7c0b6573f893a12822be39a97c2b1eb3d32408b4918b5fcaacf3271c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8094 4948 bytes
font_01_sfnt_off00009152.bin
cf5f4d469435a6d8011c068b2206d9d3e8a8bd4d8f0dbad9e0dbc9c85cd0632d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9152 11540 bytes
font_02_sfnt_off0000b69e.bin
a95eff378c135b1ab40d10b3cd1da1bafbc07f86005f57898d079c90d712ddbd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB69E 16204 bytes
font_03_sfnt_off0000cbcb.bin
ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCBCB 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.