Malicious PDF — malware analysis report

Static analysis result for SHA-256 be3b5267c148aee0…

MALICIOUS

PDF

40.8 KB Created: 2020-08-29 15:37:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 47efabea0dda810c25aeb91e5c5359af SHA-1: 3f25d45ede9f7b5d74199d475fca5ae9bd96d921 SHA-256: be3b5267c148aee07d446a46c2b1fa1a17bd69a5e58e02ff26ab9a982fe16df8
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a heuristic firing for a malicious redirector link, pointing to 'https://ttraff.com/wix?keyword=clasificaci%25C3%25B3n+de+motores+electricos'. Additionally, it exhibits characteristics of a PDF link farm, with numerous embedded URLs. The document body, though heavily obfuscated, also contains the same malicious URL and several benign-looking PDF links, suggesting a deceptive lure. No scripts were extracted from this sample.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=clasificaci%25C3%25B3n+de+motores+electricos
    • https://static.usrfiles.com/ugd/b8c837_d7202ca3fb5d4b8d985085529222a7bb.pdf
    • https://static.usrfiles.com/ugd/b8c837_dac046756b5645e0902e25a83b11bb75.pdf
    • https://static.usrfiles.com/ugd/b8c837_74ae297ff93b4b328d2d254a0eeb62d5.pdf
    • https://static.usrfiles.com/ugd/4cf28d_58e3b25b1aeb4887911451d37a193693.pdf
    • https://static.usrfiles.com/ugd/b8c837_ff64073e6f094029b9ea28720b173fae.pdf
    • https://static.usrfiles.com/ugd/49be48_c0474b1af70741db8e18aabc678b0c6a.pdf
    • https://static.usrfiles.com/ugd/b8c837_d875483a2744488dac7ae11cefa3fc74.pdf
    • https://static.usrfiles.com/ugd/5ed537_5c0427189d414d3a962675cc9669c507.pdf
    • https://static.usrfiles.com/ugd/b8c837_fa5618555b194b2882f6d66162cbb146.pdf
    • https://static.usrfiles.com/ugd/b8c837_25fb06fc31ca45c497ebd6c8e5f6d853.pdf
    • https://static.usrfiles.com/ugd/b8c837_ae87d4803963406e8ddc21f43e6480d0.pdf
    • https://static.usrfiles.com/ugd/b8c837_4751f7d4a15641ada34b4cdae5cf1ed4.pdf
    • https://static.usrfiles.com/ugd/b8c837_a0a989cf6d834ccd85f8157ec6406119.pdf
    • https://static.usrfiles.com/ugd/0dd040_e4a169b5942f44a18a8b9b27a04bec75.pdf
    • https://static.usrfiles.com/ugd/cbdbb6_d71e9b1c91474af38074cddd1f67a0ad.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005fc3.bin
2c37a6964e3413dac5161d7de9e4a51a04b338740d3d8893bbf06dce48f350d7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5FC3 5208 bytes
font_01_sfnt_off0000711a.bin
d66aa77dad015851699799e86d5d5aa2171e4c206b3c7968a4770f65df8e8f96		 pdf-font-stream PDF embedded font (sfnt) at offset 0x711A 10848 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.