Malicious PDF — malware analysis report

Static analysis result for SHA-256 f5c3713a2774ae7d…

MALICIOUS

PDF

218.9 KB Created: 2020-09-02 01:51:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b1ce00d290243f56dc6316d67f1d2e71 SHA-1: f6473e96bc8ced1b1a4cdb29b03589c0dbc0d8b3 SHA-256: f5c3713a2774ae7d77e08146500eb20d4feda0633f56d4adaa359c1c586df367
68 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.001 Malicious Link

The PDF file contains a critical heuristic firing indicating a malicious redirector link. This link, 'https://ttraff.link/wix?keyword=chronic+lymphocytic+leukaemia+treatment+guidelines', is designed to lure users to a malicious site. The document body, though heavily obfuscated, contains text related to medical treatment guidelines, suggesting a phishing or social engineering pretext. No scripts were extracted from this sample.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/wix?keyword=chronic+lymphocytic+leukaemia+treatment+guidelines
    • https://cdn.shopify.com/s/files/1/0431/2471/9773/files/asc_topic_842.pdf
    • https://cdn.shopify.com/s/files/1/0439/1328/1688/files/nunuk.pdf
    • https://cdn.shopify.com/s/files/1/0431/6626/9597/files/16056054540.pdf
    • https://cdn.shopify.com/s/files/1/0434/1684/6488/files/soundcloud_apk_latest_version.pdf
    • https://cdn.shopify.com/s/files/1/0435/6803/8049/files/sedezosipuje.pdf
    • https://cdn.shopify.com/s/files/1/0434/8595/4208/files/sarakulil.pdf
    • https://cdn.shopify.com/s/files/1/0440/5886/9910/files/how_to_rotate_screen_on_mac.pdf
    • https://static.usrfiles.com/ugd/26481d_eddfe499d1f34a06ba38d97ee4e0cd50.pdf
    • https://static.usrfiles.com/ugd/cc089a_3a2df5aafe1343619eb09134a697dd18.pdf
    • https://static.usrfiles.com/ugd/b8c837_8a102dd05cd640c09c166b36a8101432.pdf
    • https://static.usrfiles.com/ugd/a107db_9bc542ae003842f8b2b5262fd9733930.pdf
    • https://static.usrfiles.com/ugd/6cf0f5_974262e4e1c44b8bbea2d348b1e8886d.pdf
    • https://static.usrfiles.com/ugd/921909_4f8ef993c2b0477aae5640fc9733e135.pdf
    • https://static.usrfiles.com/ugd/b0c8dc_e8312f1fb2544f9198953e8aa9bf5428.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000314ca.bin
9c70da981bfc3069a74342de69e55aebcf947b37d9e88cea8e189b65303f5e7e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x314CA 5556 bytes
font_01_sfnt_off00032783.bin
2fa81c2cc48349e13ea765215fe94bf08431336c91497b972c89120e79b93d9a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x32783 17456 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.