Malicious PDF — malware analysis report

Static analysis result for SHA-256 f60af53019a245dd…

MALICIOUS

PDF

53.6 KB Created: 2020-08-31 23:46:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 877946efd0a44c7e846b5ae19fbf29bb SHA-1: 1bd27c8c8549e35bc46c933c7cb10a942b742f89 SHA-256: f60af53019a245dd1cb5241a46baa8e6da199c0876fbc54245a55706d101beea
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a significant number of embedded links, identified as a link farm. One of these links, https://ttraff.com/wix?keyword=amathanna+dj+song++jayasrilanka, points to known malicious redirector infrastructure. The document body, though heavily obfuscated, also contains this URL, suggesting it is a primary lure. The presence of a link farm and a malicious redirector indicates a likely phishing or malware distribution attempt.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=amathanna+dj+song++jayasrilanka
    • https://static.usrfiles.com/ugd/8de238_15a6709f5d884c299fecc5e283545ee1.pdf
    • https://static.usrfiles.com/ugd/5ecadc_fffc55e5c6f14abb95c551cc7ded6e73.pdf
    • https://static.usrfiles.com/ugd/b8c837_3feab1d4884540a9aa308b41debaf98c.pdf
    • https://static.usrfiles.com/ugd/ceb2e8_a55205b9662348e1823b91dd4a992699.pdf
    • https://static.usrfiles.com/ugd/9219f8_d0d6272122064a7cadb883e4302d38aa.pdf
    • https://cdn.shopify.com/s/files/1/0434/3873/5512/files/45568660144.pdf
    • https://cdn.shopify.com/s/files/1/0433/7349/4430/files/powerpoint_to.pdf
    • https://cdn.shopify.com/s/files/1/0437/7467/3050/files/behavioral_test_questions_and_answers.pdf
    • https://cdn.shopify.com/s/files/1/0431/8140/8420/files/28147311560.pdf
    • https://static.usrfiles.com/ugd/79cb75_1c5b12eea1af471c9793c0fd6f537d31.pdf
    • https://static.usrfiles.com/ugd/e5a943_f448d702321d4587a24bbfb923151c47.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000062bc.bin
352f57284ccbe89bebafb97d911a5db4890f86e02813bac5d80000f30abdd6e6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x62BC 5468 bytes
font_01_sfnt_off000074f3.bin
7784018e45ee82300e5f02ea719aace3a75aaa56ef378d9bb82fd461682179a0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x74F3 8912 bytes
font_02_sfnt_off00008ea5.bin
5c8ed98b5bbf1832725c0c90d76faa99f2fe1ab3ab858f5b267ac52c6c378d2f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8EA5 10476 bytes
font_03_sfnt_off0000b28e.bin
d33409842e6fdd029c563a6215fb28ad904c0e09f8bbf67e0ec109032f671140		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB28E 16460 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.