Malicious PDF — malware analysis report

Static analysis result for SHA-256 ca0ea0b50e85a90f…

MALICIOUS

PDF

52.1 KB Created: 2020-09-01 12:25:24 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fa605bbc71336f68eecf54ed14eaef9c SHA-1: bfcf70dcfd503c3d22b180378cd5d7f0ede9af80 SHA-256: ca0ea0b50e85a90f76e393c69fffb2fc2e3181f2f0aacb92f23829c8120b0902
140 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.001 Malicious Link T1059.001 PowerShell

The PDF file contains a link to a known malicious redirector, ttraff.com, which is disguised as a 'fall color report'. The document also contains a mass external PDF link farm, suggesting an attempt to manipulate search engine results or distribute further malicious content. The presence of a phone number lure indicates a potential callback phishing or tech-support scam scenario.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=fall+color+report+vermont+2018
    • https://static.usrfiles.com/ugd/b8c837_a58955b17278475283872132fe14e640.pdf
    • https://static.usrfiles.com/ugd/bf0735_31b063b21d884f7db6aeebbdb9f47959.pdf
    • https://static.usrfiles.com/ugd/eb4c03_1f70f973cd2f499aba8932d279527c8b.pdf
    • https://static.usrfiles.com/ugd/e3c460_3031d7f7756a4dc28696c2ad16eb8b5d.pdf
    • https://static.usrfiles.com/ugd/19103d_6b4b4ced5e5146c1a3683638fe63b81c.pdf
    • https://static.usrfiles.com/ugd/1ee69b_7821a0b73a844decbc08d9e061432852.pdf
    • https://static.usrfiles.com/ugd/fb83f1_647d8912722643fd8edf0268a7db61d2.pdf
    • https://static.usrfiles.com/ugd/b8c837_019a09f021114217a5f58feee6ad44b6.pdf
    • https://static.usrfiles.com/ugd/b8c837_c47e28b1404b461f9bbef76a301e747c.pdf
    • https://static.usrfiles.com/ugd/b48b60_729730dee95949b89d5e5e8906b37824.pdf
    • https://static.usrfiles.com/ugd/d3758e_978fe3f5a2884ebc91507ce20816f008.pdf
    • https://static.usrfiles.com/ugd/b8c837_f56671191947460eb84ea13a712d7700.pdf
    • https://static.usrfiles.com/ugd/f0e51d_2021dda7e30c461b91b4fe597e9eb156.pdf
    • https://static.usrfiles.com/ugd/b8c837_3d9adcf7f3cb4488831910998b3b39ba.pdf
    • https://static.usrfiles.com/ugd/de02f3_2b05d7d0385340399859eb7de8bdeb1a.pdf
    • https://static.usrfiles.com/ugd/b8c837_c45b466862d24e3e9a3067ae7ffe2457.pdf
    • https://static.usrfiles.com/ugd/b8c837_b935ffb06d364bbbab26a4ffbc5f59e0.pdf
    • https://static.usrfiles.com/ugd/1c8c6c_3f726b27b0db4203a8a313bb71c75ac4.pdf
    • https://static.usrfiles.com/ugd/b8c837_b44f45c77d03440097d8429de3e8c9a8.pdf
    • https://static.usrfiles.com/ugd/03ae60_96e5267144cf47248c163dff57dfbdbe.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008358.bin
020dc5c80e4fe7373fa00bad2889ae6820016614576bd240690e84478d34f331		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8358 5436 bytes
font_01_sfnt_off000095c7.bin
a36eee06fef6ce219692c4ec918276ac99413e4fd1e3666e4031624f9289d620		 pdf-font-stream PDF embedded font (sfnt) at offset 0x95C7 1800 bytes
font_02_sfnt_off00009e54.bin
e9f2c8a22b4ea233f390a7006cd5d763f1e6792575d4643a2e42e4d063785ad9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9E54 10612 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.