Malicious PDF — malware analysis report

Static analysis result for SHA-256 c04ed5da8c711b6e…

MALICIOUS

PDF

38.1 KB Created: 2020-08-30 09:52:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 50bc4c929f5b08ac459460dcefda7897 SHA-1: af64290685e760ecc0fb3fa1523d74835592bc75 SHA-256: c04ed5da8c711b6e1dcbacc0396e19c09bfabce196ca1929c3e2ec9cac10f230
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains numerous links, including one to a known malicious redirector at 'ttraff.com'. The document body, though heavily obfuscated, contains text related to 'binding of isaac afterbirth save file' and the malicious URL, suggesting a lure for users seeking game-related content. The heuristic firings indicate the PDF is designed as a link farm and a redirector, aiming to lead users to malicious infrastructure.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=binding+of+isaac+afterbirth+save+file
    • https://static.usrfiles.com/ugd/b8c837_39835e4bb17e4edfab816511a3ef0091.pdf
    • https://static.usrfiles.com/ugd/b8c837_c75bab433d8c4b67ad5ce6b245600aad.pdf
    • https://static.usrfiles.com/ugd/cbe7f7_6341d499bc82421ba88546efa6b8cbc6.pdf
    • https://static.usrfiles.com/ugd/ea78e0_aea8758e0c614306ac4dc78daffc97a7.pdf
    • https://static.usrfiles.com/ugd/d162e3_fbea4a78ae74498e92026bb15ff26165.pdf
    • https://static.usrfiles.com/ugd/b8c837_40fac45572904770b6423b61e4f8c578.pdf
    • https://static.usrfiles.com/ugd/934fc3_d4a5798ff50d4e9d8e306a95c83c00f3.pdf
    • https://static.usrfiles.com/ugd/696b8a_d7c04f1459b54e5d9d901dc281c52a2d.pdf
    • https://static.usrfiles.com/ugd/b8c837_3010b412e38b43359fd62b332d980e0e.pdf
    • https://static.usrfiles.com/ugd/0a052f_300dd4711ff24fce982eb9818f0d4bc4.pdf
    • https://static.usrfiles.com/ugd/b8c837_e04cfbe82eb043ddbcb5868b31569016.pdf
    • https://cdn.shopify.com/s/files/1/0432/5530/0249/files/16335597693.pdf
    • https://cdn.shopify.com/s/files/1/0429/3735/2358/files/wexejejuzikofuvukasoguk.pdf
    • https://cdn.shopify.com/s/files/1/0434/2602/1527/files/39246613695.pdf
    • https://cdn.shopify.com/s/files/1/0430/8402/1921/files/kepesixujini.pdf
    • https://cdn.shopify.com/s/files/1/0432/3282/1412/files/wibutorafi.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000054fd.bin
96578c869f286a99206c3208c120cb2fa90234af5fecdf0bb248b96bfd838122		 pdf-font-stream PDF embedded font (sfnt) at offset 0x54FD 5532 bytes
font_01_sfnt_off000067c7.bin
4225a5222b36e69d1e324ed86a0593b73c5d376052bc2accc9e900c66230d42e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x67C7 10496 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.