Malicious PDF — malware analysis report

Static analysis result for SHA-256 de55de8566846548…

MALICIOUS

PDF

42.1 KB Created: 2020-08-30 03:11:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6dbd0e926a33f1cf5587d48e849a6ffd SHA-1: d2a2e878b8dafb6ada7dddcc0329c3c0024d4af1 SHA-256: de55de8566846548e33d30f427070181ace17f1ed9a76121c6fd7e2a495a7db4
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a link that redirects to a known malicious domain, ttraff.ru, with a query parameter suggesting a lure related to 'Assassin's Creed Rogue blueprint locations'. The PDF also contains a large number of external links, many pointing to static.usrfiles.com, indicating a link farm or SEO poisoning tactic. The document body, though heavily corrupted, contains fragments of the lure text and the malicious URL.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=assassin%2527+s+creed+rogue+blueprint+locations
    • https://static.usrfiles.com/ugd/b8c837_1797a17a8321472e953d95c1a1e07588.pdf
    • https://static.usrfiles.com/ugd/3f80ec_f10a7d533a024e7b81595b411c6c88d8.pdf
    • https://static.usrfiles.com/ugd/a2d007_11e2bfcfa31040b18fcc25e8b426ff0f.pdf
    • https://static.usrfiles.com/ugd/b8c837_470e11c826a442f0ab865352db2ba501.pdf
    • https://static.usrfiles.com/ugd/b8c837_1c8ef90836e44f9cbfe21057f7cca750.pdf
    • https://static.usrfiles.com/ugd/b8c837_341ae77d9b094c64a0fc298cbc1c6414.pdf
    • https://static.usrfiles.com/ugd/b8c837_08e45de8b96645c083bf5be921063285.pdf
    • https://cdn.shopify.com/s/files/1/0431/5276/9192/files/bolevagabudabuliraxev.pdf
    • https://cdn.shopify.com/s/files/1/0431/5598/0445/files/3858618630.pdf
    • https://cdn.shopify.com/s/files/1/0434/8664/2338/files/horse_drawn_carriage_crossword_answer.pdf
    • https://cdn.shopify.com/s/files/1/0435/9775/8622/files/auto_mechanics_dictionary.pdf
    • https://static.usrfiles.com/ugd/9ea91e_3ff95b914f1a41db81e73bd8392780db.pdf
    • https://static.usrfiles.com/ugd/b8c837_df087bd10e5f419e8aa4f439edae7421.pdf
    • https://static.usrfiles.com/ugd/0fdb6d_5250a312317c4b4a84b25ca64f8a4c56.pdf
    • https://static.usrfiles.com/ugd/97634b_0bd0a36d36f34cf98f684826d428d8c9.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006616.bin
be8315f7e18b0870eefb43b4737715fb1197cee117e508a0bcc6f1378a67ca22		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6616 5404 bytes
font_01_sfnt_off00007876.bin
a572a2cc9163598106640af99edd92d4f5ca3cccc86d6dcda4fdaf0918d3d076		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7876 10096 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.