Malicious PDF — malware analysis report

Static analysis result for SHA-256 bffdb1417c81c4ab…

MALICIOUS

PDF

43.8 KB Created: 2020-08-31 17:43:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 62731f20ecc6195bf47828463fac4497 SHA-1: 17f718c150bf720ba38d4678644fb4531259df43 SHA-256: bffdb1417c81c4abc2ed88ada13f40f69a5664916e750b4bc02dad9d4a9baae1
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was identified as malicious due to a critical heuristic firing for a PDF redirector link pointing to ttraff.cc. Additionally, another critical heuristic detected a PDF link farm, indicating a large number of embedded external links. The document body contains obfuscated text and a URL that appears to be part of the redirection scheme. The primary attack pattern involves luring users through deceptive content and then redirecting them to potentially harmful destinations.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=michelin+star+guide+2019+nyc
    • https://static.usrfiles.com/ugd/8acad3_80f0b560ceb54a798b617be43553485c.pdf
    • https://static.usrfiles.com/ugd/cec570_e259c9e28b6a4582be30d757b70182ca.pdf
    • https://static.usrfiles.com/ugd/b8c837_db9b540fbbe147f8a512187bec583164.pdf
    • https://static.usrfiles.com/ugd/b8c837_1866dd4e82ba4919bbc9956aab0c2f54.pdf
    • https://static.usrfiles.com/ugd/9374a7_1e5d6b66ca7542cf82d248560e5f9324.pdf
    • https://static.usrfiles.com/ugd/eb4c03_5dbb2e9ca28849cea0e10718b35c9c39.pdf
    • https://static.usrfiles.com/ugd/90423f_ac7f88123eb2477d80b34501480eb3d3.pdf
    • https://static.usrfiles.com/ugd/c345b0_e65210d8b82d4c10a46671376d638a48.pdf
    • https://static.usrfiles.com/ugd/e1c37d_3e6d137aaafe4eb6a6afa73a33c68a63.pdf
    • https://static.usrfiles.com/ugd/60933b_10155a4227834919813801a2a29b7694.pdf
    • https://cdn.shopify.com/s/files/1/0428/6549/2127/files/zomanutaxuxi.pdf
    • https://cdn.shopify.com/s/files/1/0432/0300/2523/files/aviation_weather_services_advisory_circular_00_45g.pdf
    • https://cdn.shopify.com/s/files/1/0427/8861/8396/files/annexure_e_1.pdf
    • https://cdn.shopify.com/s/files/1/0431/8992/8096/files/moto_rola_t505.pdf
    • https://cdn.shopify.com/s/files/1/0433/9420/3806/files/39431510799.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006a39.bin
18a3029ca09b0638b72dc1369ced25c3c660662b55cdb5ebc4c37b2690694cb5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6A39 5788 bytes
font_01_sfnt_off00007df9.bin
9f7a86564276764a895545c4d08a447a73b1e92b1c078976bdf47d9cf0ea3d93		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7DF9 11088 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.