Malicious PDF — malware analysis report

Static analysis result for SHA-256 f6aa13c16d5f662c…

MALICIOUS

PDF

40.2 KB Created: 2020-09-03 01:19:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5f858afa9ab6f266aa88ba2f40f05222 SHA-1: 4ccbf4f01b6550236541256900de137ac544ca1d SHA-256: f6aa13c16d5f662ceb0d2b1f55834c5ccb489623737629e4ab873a22703424a7
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document was identified as malicious due to a critical heuristic firing for PDF_MALICIOUS_REDIRECTOR_LINK, indicating a link to known malicious infrastructure. Additionally, the PDF_SEO_LINK_FARM heuristic fired, revealing a large number of external links, suggesting an attempt at SEO manipulation. One of the primary links identified is to 'https://ttraff.cc/wix?keyword=astral+projection+guide', which is flagged as malicious. The document body contains garbled text but includes the same URL.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=astral+projection+guide
    • https://cdn.shopify.com/s/files/1/0434/6983/2354/files/best_pic_editing_app_for_android.pdf
    • https://cdn.shopify.com/s/files/1/0428/6929/3223/files/advanced_cardiac_life_support_download.pdf
    • https://cdn.shopify.com/s/files/1/0427/7728/0671/files/masibeboxujukukiso.pdf
    • https://static.usrfiles.com/ugd/b8c837_d875483a2744488dac7ae11cefa3fc74.pdf
    • https://static.usrfiles.com/ugd/d01287_a78724160ba7463589451f6af46e9e94.pdf
    • https://static.usrfiles.com/ugd/9eb187_70c58502d36447f48c61206549850093.pdf
    • https://static.usrfiles.com/ugd/8de238_e9dbc1487f1a49afa5336bb07ed2e047.pdf
    • https://static.usrfiles.com/ugd/e4a001_312ad1be708d4a4ea138bfe5bad6dfca.pdf
    • https://cdn.shopify.com/s/files/1/0429/8375/1831/files/avery_insertable_dividers_11200_template.pdf
    • https://cdn.shopify.com/s/files/1/0432/9072/2454/files/aithey_aa_lyrics_song.pdf
    • https://cdn.shopify.com/s/files/1/0431/4339/7525/files/505594211.pdf
    • https://cdn.shopify.com/s/files/1/0428/4583/1335/files/propiedades_fisico_quimicas_del_agua.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005e6d.bin
df671607b85072e4fe3a5018024c705fb93a9d1f3f8f9553acf81ffdc65f54e4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5E6D 5304 bytes
font_01_sfnt_off0000708a.bin
2b3c83df60c258cf5909265a41697bf9dc4f12607cfe9d2a4951ee93ef716fed		 pdf-font-stream PDF embedded font (sfnt) at offset 0x708A 10636 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.