Malicious PDF — malware analysis report

Static analysis result for SHA-256 ce58855b25dfcba1…

MALICIOUS

PDF

42.6 KB Created: 2020-09-01 02:21:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7078ce962e110aa70d6402733183a533 SHA-1: 0fb403ddb440807ccd104fa75adace5cced883fb SHA-256: ce58855b25dfcba1a8fc96e73986ec799ba595edcab18dee1137c333a0f642b3
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.001 User Execution: Malicious Link T1059.001 Command and Scripting Interpreter: PowerShell

The PDF file contains a heuristic firing for a malicious redirector link, which is also present in the document body. The link leads to 'https://ttraff.com/wix?keyword=malaria+treatment+guidelines+cdc', suggesting a lure related to medical information to entice users to click. The file also exhibits characteristics of a link farm, with numerous embedded links to external PDFs, likely to improve search engine ranking and distribute malicious content.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=malaria+treatment+guidelines+cdc
    • https://static.usrfiles.com/ugd/6846fe_a7d939e7f1114505bdb5523fc41ff48e.pdf
    • https://static.usrfiles.com/ugd/b8c837_d431b805142644bca6967532d48adb4b.pdf
    • https://static.usrfiles.com/ugd/1cc7e8_838f4738ac7742c48d0da354b57ac592.pdf
    • https://static.usrfiles.com/ugd/73c254_e26f67e9617a4d57a1699b12b2fb3f77.pdf
    • https://static.usrfiles.com/ugd/0511f5_aafc0784263e4b2bb8aeb7b45a0bd089.pdf
    • https://static.usrfiles.com/ugd/74a852_04b1d1204ebc4cfdb2035a0ba5bdfbb1.pdf
    • https://static.usrfiles.com/ugd/67f5f7_4d57ed6099e4443d81c4c1cd8dd7b923.pdf
    • https://static.usrfiles.com/ugd/b8c837_c8ee3abb576b4557852bebcd4eb23a4c.pdf
    • https://cdn.shopify.com/s/files/1/0430/6403/3429/files/bbg_kayla.pdf
    • https://cdn.shopify.com/s/files/1/0432/2597/2904/files/58249848562.pdf
    • https://cdn.shopify.com/s/files/1/0432/8305/4757/files/kuvapopetupegilifupu.pdf
    • https://cdn.shopify.com/s/files/1/0438/2972/3293/files/sefenexukoje.pdf
    • https://static.usrfiles.com/ugd/cec570_5937045c83954b4b98c3cacbfb95af82.pdf
    • https://static.usrfiles.com/ugd/fa32a6_d32bd11903a840e09640b1d395e313c5.pdf
    • https://static.usrfiles.com/ugd/9e53d4_baadacc40aa0435488f2594937d2ea47.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006837.bin
2051e5362f1ee4f64d152374adc234011c276461e3c0f10265196b913f63508b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6837 5264 bytes
font_01_sfnt_off00007a0f.bin
867dc462726691ce127ab565fc2c9b889ea89e86fd1257afa2392ff7101e40c4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7A0F 10648 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.