Malicious PDF — malware analysis report

Static analysis result for SHA-256 e5004b5a3d18ee4c…

MALICIOUS

PDF

40.5 KB Created: 2020-08-31 02:54:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7bc5c58729aff61c915fe10a366b64cb SHA-1: 8c07d1a4ece1ac5bd85509245d983e097d899ee7 SHA-256: e5004b5a3d18ee4c035a995740cbdf90ef552ebaf1043eb7fdcb34fa6cfbc414
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a heuristic firing for a malicious redirector link pointing to 'ttraff.com', which is used in a lure related to a mental health association. Additionally, it contains a large number of embedded links, many pointing to 'static.usrfiles.com', suggesting a link farm or SEO poisoning tactic to distribute malicious content. The document body, though heavily obfuscated, contains the target URL and keywords that align with the redirector's query parameters.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=oklahoma+mental+health+association
    • https://static.usrfiles.com/ugd/bd5c68_3b96bd6f444e4d59af5f55b8a6f570e2.pdf
    • https://static.usrfiles.com/ugd/6cf392_9e7ab9a8e9e94c8ab4818e208b255712.pdf
    • https://static.usrfiles.com/ugd/7f16bd_6d6077a8bd0a43eabf16454197e67c00.pdf
    • https://static.usrfiles.com/ugd/ade4e6_f393d6eab4ea470a8a6bf045645c30cb.pdf
    • https://cdn.shopify.com/s/files/1/0432/0873/6927/files/dovepoxi.pdf
    • https://cdn.shopify.com/s/files/1/0431/7279/0427/files/5915151179.pdf
    • https://static.usrfiles.com/ugd/b8c837_b8c25b3b1e3b488087489b27d736c541.pdf
    • https://static.usrfiles.com/ugd/79cb75_5389acacb4df4b348dfa49da0cecc962.pdf
    • https://static.usrfiles.com/ugd/b88e3d_f9f3ba0166e245f996ebeba6e624c0c3.pdf
    • https://static.usrfiles.com/ugd/b8c837_9152adba514f4e8fa39da77a059d4bd7.pdf
    • https://static.usrfiles.com/ugd/0e2875_aa902443274a4ccdbd42e32bf2599122.pdf
    • https://static.usrfiles.com/ugd/b8c837_3b48bc90b04548f5aeea4302140446c2.pdf
    • https://static.usrfiles.com/ugd/ac72e0_615585823354468aa8a53224e43dc006.pdf
    • https://static.usrfiles.com/ugd/e3ff21_8afac34ad8874e69bbeff2b327a71ac0.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000610d.bin
194d95333aefd7550da0f53a9ae930f82fb5304dcb9daab9b64c596997634bda		 pdf-font-stream PDF embedded font (sfnt) at offset 0x610D 5032 bytes
font_01_sfnt_off0000720e.bin
565870bd9f426e7a83a8a5394d3196effef7db11dec59bc0a7d53692f4c731a1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x720E 10348 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.