Malicious PDF — malware analysis report

Static analysis result for SHA-256 c0a8c1ed2fc80224…

MALICIOUS

PDF

43.3 KB Created: 2020-08-29 23:17:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5dc02be2d003bff0b0ceedff72f47f20 SHA-1: 59b18b1fbdc457e17d9ed9b51bb103a1a936c852 SHA-256: c0a8c1ed2fc802240fe222e3ebb17ae976f4fb173aac62073584e7429b99a169
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a heuristic firing for a malicious redirector link, pointing to 'https://ttraff.cc/wix?keyword=la+col%25C3%25A8re+du+tueur+t%25C3%25A9l%25C3%25A9charger'. The document body, though heavily obfuscated, contains this URL and other links to static.usrfiles.com, suggesting a lure to a malicious site. The presence of a link farm heuristic further indicates malicious intent to distribute content or redirect users.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=la+col%25C3%25A8re+du+tueur+t%25C3%25A9l%25C3%25A9charger
    • https://static.usrfiles.com/ugd/b8c837_2dfd60b35f3e44b8b92fc60f917c2efa.pdf
    • https://static.usrfiles.com/ugd/b8c837_e35fb9174f764b579e129f622a8f2444.pdf
    • https://static.usrfiles.com/ugd/b8c837_93241c886a3e4ff28d10ec4dead6cf3e.pdf
    • https://static.usrfiles.com/ugd/b8c837_af64b28627cd4bec8224d9ecbae77549.pdf
    • https://static.usrfiles.com/ugd/b8c837_0c93cdf559994137aac924232026cf28.pdf
    • https://static.usrfiles.com/ugd/b8c837_b8ac8470e0cb42a2a898a88c7b77eccc.pdf
    • https://static.usrfiles.com/ugd/b8c837_4631331d8c244dd9b1bd6ea3604d24a1.pdf
    • https://static.usrfiles.com/ugd/8b97dd_821a9729eec6496fb706b8ec89fb6cfd.pdf
    • https://cdn.shopify.com/s/files/1/0433/5842/1142/files/functional_morphology_in_vertebrate_paleontology.pdf
    • https://cdn.shopify.com/s/files/1/0432/3780/2146/files/pesof.pdf
    • https://cdn.shopify.com/s/files/1/0437/2591/4277/files/tudegegikuzas.pdf
    • https://static.usrfiles.com/ugd/b8c837_a292157288c34cb6a8fde7ba316f5abb.pdf
    • https://static.usrfiles.com/ugd/b8c837_a7fdc11a3a664d91b2e4b417fcf2e36d.pdf
    • https://static.usrfiles.com/ugd/b58d21_468e46d83d4a4a66a52abf1f5a0a0427.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000590d.bin
801b1f03c21a200dcd536d1e6a9cdd554ee9dcdddd69a684df9c0e410188a792		 pdf-font-stream PDF embedded font (sfnt) at offset 0x590D 4976 bytes
font_01_sfnt_off0000696e.bin
9d4c70b436fb20b50e0253c61876247e41877510cc7730dace6056c6b767299f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x696E 12332 bytes
font_02_sfnt_off0000904c.bin
0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333		 pdf-font-stream PDF embedded font (sfnt) at offset 0x904C 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.