Malicious PDF — malware analysis report

Static analysis result for SHA-256 f2db86145c4506a0…

MALICIOUS

PDF

42.8 KB Created: 2020-09-18 06:51:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 555e05bf1ff63e59f197b06ab466d9a2 SHA-1: 5072ddf27e5d2594d8857d8a23c9717cbdc00c57 SHA-256: f2db86145c4506a0d8d77b34b979aeb1eadc41f561c700c16a8ca216c19a2045
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a heuristic firing for a malicious redirector link, disguised with a movie title to entice clicks. It also exhibits characteristics of a link farm, with numerous embedded URLs pointing to external PDF documents. The primary malicious URL is https://ttraff.link/wix?keyword=terminator+2+pelicula+completa+subtitulada+espa%25C3%25B1ol, which is likely used to deliver a secondary payload or redirect to a phishing site.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/wix?keyword=terminator+2+pelicula+completa+subtitulada+espa%25C3%25B1ol
    • http://titoluw.reasonandjustice.com/uploads/1/3/1/4/131437350/laxeridin_gogenunafu_zupoxetal_luxibugov.pdf
    • http://fitanuxo.motionzone.org/uploads/1/3/0/7/130740598/52055461340b.pdf
    • https://b6424213-f79d-4ed4-a65f-2c8bb3bc1658.filesusr.com/ugd/65b209_21741fff20404b3db6c78e64bca6f14b.pdf?index=true
    • https://7e46b8af-5fa6-4a34-bac6-93ac524fd78c.filesusr.com/ugd/85d67f_4269162606504f1793f4d264ac84b0f8.pdf?index=true
    • https://6035ffe9-9294-4398-92c2-8b10397e4928.filesusr.com/ugd/d19ca0_644ff732ae884582a9e639cc95085648.pdf?index=true
    • https://cdn.shopify.com/s/files/1/0430/0223/2983/files/mudegomunifolojotiwo.pdf
    • https://cdn.shopify.com/s/files/1/0431/1485/6610/files/74762433193.pdf
    • https://cdn.shopify.com/s/files/1/0433/0933/4683/files/automatic_door_opening_and_closing_system_project.pdf
    • https://cdn.shopify.com/s/files/1/0438/3421/2509/files/40856283003.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/37394074323.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005a3b.bin
f6d9750084ca586ddd1625d452ac3f0785d1b0cdb4597747e057341a37b982a2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5A3B 5652 bytes
font_01_sfnt_off00006d05.bin
dce7c44b05fc1f41d6b4b650c8b85fd00755165e6a17d35102d99b04d8cd85d1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6D05 2204 bytes
font_02_sfnt_off00007709.bin
251833830896da282c3739d5c75c378963220a6b6e98bc76144d8bd286a620ee		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7709 11236 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.