Malicious PDF — malware analysis report

Static analysis result for SHA-256 d6e9f759c21dfdd2…

MALICIOUS

PDF

41.1 KB Created: 2020-08-30 20:19:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6c6bb851d88e8bf5b615946539a883f1 SHA-1: 42184a10fd267cc6c72e544f47680681402ccb7f SHA-256: d6e9f759c21dfdd2aa6800b1035b8e0326eb071808b7ec8c7e9682f3faeaf440
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document was identified as malicious due to its structure, which includes a large number of external links. One of these links, https://ttraff.com/wix?keyword=tensor+de+inercia, points to known malicious redirector infrastructure. The document body contains garbled text but includes the same malicious URL and a benign-looking PDF URL, suggesting a lure to a link farm designed to lead users to malicious content.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=tensor+de+inercia
    • https://static.usrfiles.com/ugd/b8c837_849a8febcf734a0292e4c09faf8f00b1.pdf
    • https://static.usrfiles.com/ugd/5b5da7_49748578b3ba4051958c8b61808774b2.pdf
    • https://static.usrfiles.com/ugd/d775a9_71b91fec57584d0c9b1536ece1b96491.pdf
    • https://static.usrfiles.com/ugd/b8c837_f0ebfcabce4c4cf0a162a5a8fcf1f344.pdf
    • https://cdn.shopify.com/s/files/1/0432/2508/8168/files/90773527362.pdf
    • https://cdn.shopify.com/s/files/1/0434/5665/9617/files/64152570733.pdf
    • https://cdn.shopify.com/s/files/1/0432/5349/8019/files/zotero_annotation.pdf
    • https://static.usrfiles.com/ugd/b58d21_9295514f79764b56b72d47b54f837de4.pdf
    • https://static.usrfiles.com/ugd/b8c837_311f7dd521204dd58dfe8bf5f63acd8d.pdf
    • https://static.usrfiles.com/ugd/b8c837_108fc8ab29a64a10a410ea0c5d2b291a.pdf
    • https://static.usrfiles.com/ugd/4b874d_74b0444f277e471ebc106a6034aa0607.pdf
    • https://static.usrfiles.com/ugd/b8c837_3daa7cc62bae48708f7609399e071a1b.pdf
    • https://static.usrfiles.com/ugd/23e9be_404a651b2b8c405cbbf48668798451d3.pdf
    • https://static.usrfiles.com/ugd/b8c837_718bb31baaeb4d43b6c8e52a6d7fb111.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000665a.bin
8c919721a7e8245535d12640bfedf1f6eeca7d139947251e09d0871be767e05e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x665A 4848 bytes
font_01_sfnt_off000076db.bin
a39f113f8b204d17e3fead0549521cb68c74405f3c9e1c7995a03d8183a5fd9c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x76DB 9708 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.