Malicious PDF — malware analysis report

Static analysis result for SHA-256 e38ebb3214df0dbe…

MALICIOUS

PDF

45.9 KB Created: 2020-09-01 03:50:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7c41f8c4daabdd429923c4b920ea4419 SHA-1: 922ba2d05b5a9d9b7798625be17d6d9a2f69ac64 SHA-256: e38ebb3214df0dbeac595720da907fe756dd430fe4a8029388212a4b6f3b65f6
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.cc/wix?keyword=risk+assessment+army+answers'. This URL is embedded within the document body, suggesting an attempt to trick the user into visiting a malicious site. The presence of a PDF link farm heuristic further indicates a pattern of distributing links, likely to facilitate phishing or malware delivery. No scripts were extracted from this sample.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=risk+assessment+army+answers
    • https://static.usrfiles.com/ugd/b8c837_a549923e13cf4248b8a2f4a604685c78.pdf
    • https://static.usrfiles.com/ugd/f63f29_a75f75a6d2ec4f0cbeee26df08e34db8.pdf
    • https://static.usrfiles.com/ugd/b8c837_53e8f6c744ad4c91b07e0a08e93016c5.pdf
    • https://static.usrfiles.com/ugd/8e1900_d1015f984db44ecb972691d18af62b7a.pdf
    • https://cdn.shopify.com/s/files/1/0427/9628/6111/files/83298978762.pdf
    • https://cdn.shopify.com/s/files/1/0438/2847/8102/files/list_of_autoimmune_diseases.pdf
    • https://cdn.shopify.com/s/files/1/0441/0405/6984/files/template_ppt_plus_animasi.pdf
    • https://cdn.shopify.com/s/files/1/0429/0222/5059/files/75267789639.pdf
    • https://cdn.shopify.com/s/files/1/0432/7469/8912/files/human_psychology_books_in_bengali.pdf
    • https://static.usrfiles.com/ugd/b85eb0_4dfa647635134c15b6497d397a91e642.pdf
    • https://static.usrfiles.com/ugd/4d6844_07368b4bf1c64f12b323b18ddfff5185.pdf
    • https://static.usrfiles.com/ugd/b8c837_7201f6fead11433995dd04fb9a5e2270.pdf
    • https://static.usrfiles.com/ugd/b8c837_eebae45992ab439ba4e4491924dd2d86.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000690e.bin
b7f83aecffe312ffb13ca10069589d048a5fad50d1808dfc76ccf5e0fa31c52d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x690E 4744 bytes
font_01_sfnt_off00007917.bin
2403b2c1b63fff12c0e883ae43e0ef915d5204283314901bd86ed10f06e63049		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7917 10468 bytes
font_02_sfnt_off00009cd1.bin
4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9CD1 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.