Malicious PDF — malware analysis report

Static analysis result for SHA-256 bc0c786695b17cd8…

MALICIOUS

PDF

39.5 KB Created: 2020-09-01 08:51:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4c0782616faa3132a4e522fbc24d0435 SHA-1: 8bcb9a01ff1f89af7e11ffe0238513c043a667cb SHA-256: bc0c786695b17cd8b7b5b72b2fa49d15652f41e738e0a8ec3234858aa8dcaf0d
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains multiple embedded links, with one critical heuristic identifying a link to a known malicious redirector. The document body, though heavily obfuscated, contains text related to 'cabra dominican college new uniform' and the malicious URL, suggesting a lure. The presence of numerous links, many pointing to static.usrfiles.com, indicates a link farm designed to obscure the ultimate destination. The primary malicious IOC is the ttraff.com redirector URL.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=cabra+dominican+college+new+uniform
    • https://static.usrfiles.com/ugd/c5d40f_1f7ab6b63b7d4e2dbb48da9f26c225bb.pdf
    • https://static.usrfiles.com/ugd/b8c837_f5eccc9b80a5459c9e43c2885ebfc1c8.pdf
    • https://static.usrfiles.com/ugd/c618e9_51ee5384186541beb44421ed37afcba0.pdf
    • https://static.usrfiles.com/ugd/b8c837_2315b7a1417f4ee090454115d492b947.pdf
    • https://static.usrfiles.com/ugd/a4d998_6fa1279becac4862b7e246e60071f522.pdf
    • https://static.usrfiles.com/ugd/eda9ba_7658a9f8f8ed4cbc9af05ef636705e1a.pdf
    • https://static.usrfiles.com/ugd/b8c837_98530b8ca05547a48c03e4009db7ffc4.pdf
    • https://static.usrfiles.com/ugd/b8c837_dfb3f0fb8f694c62ba1aebb548656911.pdf
    • https://static.usrfiles.com/ugd/b8c837_bc4811e10edb45acbd096aa9428404c1.pdf
    • https://static.usrfiles.com/ugd/b916f4_ba40d3875f5e4c73aee2e0e1cccd4258.pdf
    • https://static.usrfiles.com/ugd/b8c837_ac398deca5044b7582632b355e49fdfb.pdf
    • https://static.usrfiles.com/ugd/b8c837_d53bc815e558492dad8179af7870df1e.pdf
    • https://static.usrfiles.com/ugd/f09a9d_509d031c42b443ffa930bfa5914c2dc5.pdf
    • https://cdn.shopify.com/s/files/1/0433/7863/9013/files/dodecahedron_book_report.pdf
    • https://cdn.shopify.com/s/files/1/0434/6282/0005/files/juliwadulewekijuzob.pdf
    • https://cdn.shopify.com/s/files/1/0429/8578/3447/files/24509693880.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005a8d.bin
fe48336d5092f9e0df608185299cc6a7851a49404f67ec0ae02b676eb39c15d0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5A8D 5300 bytes
font_01_sfnt_off00006c8b.bin
04bb3c231edd5af252ff380fa82b7f0e4a3dc622e2b7e68a0d0cda51fc70c20f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6C8B 11140 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.