Malicious PDF — malware analysis report

Static analysis result for SHA-256 cfce6cd7648fe577…

MALICIOUS

PDF

35.5 KB Created: 2020-09-05 14:40:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3ebab65148f7b9b782c427d9f4b781dc SHA-1: 091ea25316e362f25defb0451709101925c005fe SHA-256: cfce6cd7648fe577df9887d33e51b7da23a41efcefdde4fdc4492dd3d8b10cdf
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, many of which point to a link farm hosted on static.usrfiles.com. One of these links, https://ttraff.link/wix?keyword=carpenter+song+free, is flagged as a malicious redirector. This suggests the document's primary purpose is to redirect users to malicious infrastructure, likely for further exploitation or phishing.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/wix?keyword=carpenter+song+free
    • https://cdn.shopify.com/s/files/1/0435/8170/2301/files/gabasoxupisasowozeboz.pdf
    • https://cdn.shopify.com/s/files/1/0431/8219/4852/files/gagizebapini.pdf
    • https://cdn.shopify.com/s/files/1/0434/5059/7528/files/louisiana_cities_by_population.pdf
    • https://cdn.shopify.com/s/files/1/0434/0970/3061/files/17684275701.pdf
    • https://cdn.shopify.com/s/files/1/0431/5276/9192/files/jofavibumigizo.pdf
    • https://static.usrfiles.com/ugd/205ae4_bdefe9b5b6b240668297cf3eecc8e587.pdf
    • https://static.usrfiles.com/ugd/b28561_1418eba9d5244a4b8d3ffde2b405e432.pdf
    • https://static.usrfiles.com/ugd/3f80ec_1c27db25f97f48d4bb73cea0907ff5f6.pdf
    • https://static.usrfiles.com/ugd/b8c837_8731ca8a8b6c45afb1c21e8d644fb998.pdf
    • https://static.usrfiles.com/ugd/c3f59f_b0e30de32d8d4043a3ef0b49015ee7b9.pdf
    • https://static.usrfiles.com/ugd/d9e9a0_2be0fb389c14479abf5e881aa4896132.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004cf9.bin
5dbc56df7ceeafa7e0569955f5a8dca5b5643c936441b4c08157913d0e88ee6d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4CF9 4940 bytes
font_01_sfnt_off00005dda.bin
f7cbcfde240c80ab36d773e5d2fff758363c22da17d51dffe4c89bb66f42d656		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5DDA 10580 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.