Malicious PDF — malware analysis report

Static analysis result for SHA-256 e3af1a1f302dfd99…

MALICIOUS

PDF

44.4 KB Created: 2020-09-01 05:57:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 63220c2b47b7cbf403bae5576594eaf1 SHA-1: bdfe2de2db6a35ee57e5be8348a0ee47b11a3a30 SHA-256: e3af1a1f302dfd99034fc57f7e79821221e7b487100b0b6c6b6e14140cc04fd8
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a heuristic firing for a malicious redirector link, specifically pointing to 'https://ttraff.cc/wix?keyword=android+studio+emulator+google+play+services+update'. The document body, though heavily obfuscated, also contains this URL and references to 'Android studio emulator google play services update', suggesting a lure. The PDF also exhibits characteristics of a link farm, with numerous embedded URLs pointing to static.usrfiles.com, likely for SEO manipulation or to host further malicious content.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=android+studio+emulator+google+play+services+update
    • https://static.usrfiles.com/ugd/ce77c6_790f97814d6e42278652c5cb7f9623cc.pdf
    • https://static.usrfiles.com/ugd/b8c837_77221a66c268461892ee2ec5bfdc527b.pdf
    • https://static.usrfiles.com/ugd/b8c837_1c8ef90836e44f9cbfe21057f7cca750.pdf
    • https://static.usrfiles.com/ugd/57c819_e4c9009dddc644bdae394ef697736eb2.pdf
    • https://static.usrfiles.com/ugd/67e251_8e195085ef0a4ba1b58e2c289bea81c1.pdf
    • https://static.usrfiles.com/ugd/e7e4a0_738708dbf4c9438185bc2a84f1df4202.pdf
    • https://static.usrfiles.com/ugd/7f16bd_ced790b37b764c57ac6d42192501181c.pdf
    • https://cdn.shopify.com/s/files/1/0435/4523/1509/files/mefevoxigefe.pdf
    • https://cdn.shopify.com/s/files/1/0430/2385/9873/files/bewomipiso.pdf
    • https://cdn.shopify.com/s/files/1/0434/1566/6840/files/libro_apologia_de_socrates_de_platon.pdf
    • https://cdn.shopify.com/s/files/1/0434/4794/3330/files/manuale_di_agricoltura_biodinamica.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/77363931764.pdf
    • https://static.usrfiles.com/ugd/9d869b_94a9c33822ff4c938b5bdb83755dfb8d.pdf
    • https://static.usrfiles.com/ugd/8b4172_a6a500298c4a4f63bab52d2dbc0413f7.pdf
    • https://static.usrfiles.com/ugd/cc03df_4f6bc9a3c97e4e0eb921c517d80efc04.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006dfb.bin
80929408645d5a1b6fcd2817356f8cf7955594bc0391fbbf84acd140e867e0ef		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6DFB 5544 bytes
font_01_sfnt_off000080ce.bin
43bff4b4b80945554f370b0c5e8d7c49590c8fc14fc3aca3cd8b5bd97b0a1d11		 pdf-font-stream PDF embedded font (sfnt) at offset 0x80CE 10420 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.