Malicious PDF — malware analysis report

Static analysis result for SHA-256 e07f7c64f961a881…

MALICIOUS

PDF

41.7 KB Created: 2020-09-17 12:18:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4edb3ab798c192eb5c8e4d7f2e0e5ff6 SHA-1: 72f6ad89749b61a87276069fea5b120c26c7407f SHA-256: e07f7c64f961a8815510528d7fa862b7bc34b1d8fd755d81786fd5c3a1bcc8c2
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a heuristic firing for a malicious redirector link, directing users to 'ttraff.me'. Although the document body text is heavily obfuscated, it contains the same URL. The file also exhibits characteristics of a link farm, with numerous embedded URLs pointing to external PDF documents, one of which is identified as a malicious redirector.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=linear+word+problems+in+standard+form+worksheet
    • https://59d5f3d6-64fe-452e-9f69-c45bf6ac217f.filesusr.com/ugd/76156b_bae2ead255334ca0bb051387f99be321.pdf?index=true
    • https://36459dcd-c992-4acc-8ba1-679321e87a87.filesusr.com/ugd/f1780b_86cafb427a8a407baedec6d18a22a64d.pdf?index=true
    • https://e15e4ed3-6649-4708-a818-06dfd1edf041.filesusr.com/ugd/d7c203_fe17213e12904c018e4ac3d8ae640b22.pdf?index=true
    • https://09c68665-aea1-48b7-b053-415ce804c13c.filesusr.com/ugd/9ff9b8_74492b44cfd049c5b1beea831b143a04.pdf?index=true
    • https://0d4d10b9-8e97-4419-945e-6b15673e912f.filesusr.com/ugd/17ce20_cbd2828935dc4c89ac2a9bf79c77240d.pdf?index=true
    • https://cff1100f-7e1a-49bf-adb9-89e897d12642.filesusr.com/ugd/868b90_dfdb7841ca8f4be8968d75b352f6ea8b.pdf?index=true
    • https://f2f2c6a9-3929-4519-a5ba-978ae50cdd55.filesusr.com/ugd/c638b7_8ac8b7e427b14098bef31bf8cb078d99.pdf?index=true
    • https://4326b4c8-da37-48de-a030-81ac02241a37.filesusr.com/ugd/bdc04d_4dd74b80fac3431083433952ef7bfa90.pdf?index=true
    • https://da000599-6013-4eb7-9958-30434b1ae758.filesusr.com/ugd/1479de_b167b6faa2014366a0f0303b44da9a62.pdf?index=true
    • https://d8026418-aabe-4f6f-9769-f9d62c9c2cef.filesusr.com/ugd/724fb5_1dcee7ea933e406fa77fcd5bb0a210b6.pdf?index=true
    • https://62aeee9e-2455-4ecb-b9f5-ecb1ff9e21e3.filesusr.com/ugd/26481d_3882ce73bf23429ea5c32daf3e05d7ec.pdf?index=true
    • https://55ed31bb-0748-481f-a687-63e635f41e91.filesusr.com/ugd/7f46b5_e99c2fe633064e3eb2d3128c89b37191.pdf?index=true
    • https://29dedfce-b209-41ff-843e-43bcbb692169.filesusr.com/ugd/e2c223_770c309cfd5b49ffb3a15db5562d2edf.pdf?index=true
    • https://6a36553a-d054-4d59-b8e2-8c1278adac76.filesusr.com/ugd/1cc7e8_341ecfa62d544f668dbbda2eb63d9374.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://29dedfce-b209-41ff-843e-43bcbb692169.filesusr.com/ugd/e2c223_770c309cfd5b49ffb3a15

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000561a.bin
00c5258da1eaa62884559ce7e4467bef70f225023ff648bca3bc230a7b902eab		 pdf-font-stream PDF embedded font (sfnt) at offset 0x561A 5308 bytes
font_01_sfnt_off000067fe.bin
9d21aa9134c1d6f330f12d4de614c2ece468eb34b610bdf3e8f67647772c5f6b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x67FE 10428 bytes
font_02_sfnt_off00008b6a.bin
ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8B6A 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.