Malicious PDF — malware analysis report

Static analysis result for SHA-256 bbddc09131c7c776…

MALICIOUS

PDF

38.3 KB Created: 2020-09-01 03:30:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 884607166a2a951d251cebedce3c6dca SHA-1: a71c457b789f53abfd3198e5c00a05af5ba01027 SHA-256: bbddc09131c7c776e231f01755038b0d9d393c1c7de68cfd529e741bbfbaf590
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a heuristic firing for a malicious redirector link, directing users to 'https://ttraff.cc/wix?keyword=simile+and+metaphor+worksheet+year+4'. The document body, though heavily obfuscated, appears to contain references to educational material, likely a lure. The file also exhibits characteristics of a link farm, with numerous embedded URLs pointing to external PDF documents, many hosted on static.usrfiles.com. No scripts were extracted from this sample.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=simile+and+metaphor+worksheet+year+4
    • https://static.usrfiles.com/ugd/cc089a_b373e7489e4a4b0bb361de8ed37e4f59.pdf
    • https://static.usrfiles.com/ugd/4dd980_c29f65f6fbfb464589a03433a026a02a.pdf
    • https://static.usrfiles.com/ugd/b8c837_affdca35539d4e3f84b75cf182a391b1.pdf
    • https://static.usrfiles.com/ugd/f0f215_2249f229c5cb44bea1e546a2ec523166.pdf
    • https://static.usrfiles.com/ugd/30e015_4f0870ded603448db0fcb537bbf755df.pdf
    • https://static.usrfiles.com/ugd/9219f8_6db19bc9c9bc4d7ca1ee63e7a5f3c075.pdf
    • https://cdn.shopify.com/s/files/1/0429/3709/0211/files/62435534565.pdf
    • https://cdn.shopify.com/s/files/1/0457/7860/0102/files/14891083816.pdf
    • https://cdn.shopify.com/s/files/1/0427/6345/2583/files/fakomowifijovelapi.pdf
    • https://cdn.shopify.com/s/files/1/0434/6170/5888/files/agrochemicals_books.pdf
    • https://cdn.shopify.com/s/files/1/0431/0538/6647/files/vukozuliluxigijutibetim.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000579b.bin
a47d4f170b292cf7925fc4ce21aa89784d3a918ffaca1381f7cc9a3f77daf38f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x579B 5648 bytes
font_01_sfnt_off00006ac2.bin
2ad56faf1733982c3a30f51b5774b89e360fe9a341485026e2a82deab85a9eba		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6AC2 9980 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.