Malicious PDF — malware analysis report

Static analysis result for SHA-256 f1fa1e9623eb1068…

MALICIOUS

PDF

129.2 KB Created: 2020-09-06 21:58:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1b81a1567b0627873fc170011322924e SHA-1: 8ae478825be0c963fe3da8c0093946198625eb66 SHA-256: f1fa1e9623eb1068bd938d721b4104a82d0c364170f46cc5b8c91626aed4b9f2
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'ttraff.com', which is further associated with a link farm of other PDFs. The document body, though heavily obfuscated, contains the same URL. This suggests a phishing or social engineering attack aiming to direct users to potentially malicious content.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Remote-support tool lure high SE_REMOTE_SUPPORT_LURE
    Document instructs the user to install, open, or connect with a remote-support tool such as AnyDesk, TeamViewer, Quick Assist, or ScreenConnect — high-risk in an unsolicited document
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=blynk+hacked+apk
    • https://static.usrfiles.com/ugd/c33cdb_ed50b82361304a00bacaac032cec0577.pdf
    • https://static.usrfiles.com/ugd/16a96a_e11b434b86284537bda9a0f43f8668ac.pdf
    • https://static.usrfiles.com/ugd/9ff9b8_2f967464a9164e68a788635a9e97456a.pdf
    • https://static.usrfiles.com/ugd/912de2_dded1aac50aa425cb2143b1622e7a7a3.pdf
    • https://cdn.shopify.com/s/files/1/0435/6934/8763/files/argumento_ontologico.pdf
    • https://cdn.shopify.com/s/files/1/0449/3633/1419/files/boardwalk_empire_season_5_torrent.pdf
    • https://static.usrfiles.com/ugd/289c5e_61413ae497c44579b6ff12014df93e55.pdf
    • https://static.usrfiles.com/ugd/b8c837_b60e867d04ef4ba2a0132c422b7b7d6b.pdf
    • https://static.usrfiles.com/ugd/b8c837_a96b52027037426995c4055e1696a306.pdf
    • https://static.usrfiles.com/ugd/b7306e_92c2b88c03b8450685169147700da8dc.pdf
    • https://static.usrfiles.com/ugd/52b593_882d86c599f649a28d846fc2b63f57e5.pdf
    • https://static.usrfiles.com/ugd/5438e3_7296a5337d8e4377ab951c51125f07bb.pdf
    • https://static.usrfiles.com/ugd/98e2de_cd2c75849e3544f4ad4ad72a27ff698f.pdf
    • https://static.usrfiles.com/ugd/e1c37d_88acb97b488e422e8528e6cf4c4953b9.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00018083.bin
26882276e64fcb3c44c514da81331e5e05faf0ba1aebfd41a6e0e2032e556152		 pdf-font-stream PDF embedded font (sfnt) at offset 0x18083 3072 bytes
font_01_sfnt_off00018b7e.bin
771b8bfa3c0b43eff977fc31e8578034f64cc6818a5eab3574ab46725911ef35		 pdf-font-stream PDF embedded font (sfnt) at offset 0x18B7E 5104 bytes
font_02_sfnt_off00019cdb.bin
61324b4e89704b5c7c43071940151ec2297f0e19bc0021c470858833887b5963		 pdf-font-stream PDF embedded font (sfnt) at offset 0x19CDB 2940 bytes
font_03_sfnt_off0001a8d9.bin
780f8fd7000dafbfcfbdd0ef93edb49e48b1c63d8c01684c058f3a0ea9ebe1f1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1A8D9 17528 bytes
font_04_sfnt_off0001de92.bin
735fce07fce670b68888e4d35a37a94d9b8f3b4dc5bff13f2a117e29ae9a43f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1DE92 16796 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.