Malicious PDF — malware analysis report

Static analysis result for SHA-256 f6e402c688c1beac…

MALICIOUS

PDF

112.5 KB Created: 2020-08-29 04:33:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7c55fe28e780258f8ead76f4ec8ee09c SHA-1: d28e03e852ae83fb2a965491c5cd56876cd1b181 SHA-256: f6e402c688c1beac2d4f95622497181e8b550eb759ce03ec8563a79fcbd21ad4
188 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF file contains multiple heuristics indicating malicious intent, including a critical finding of a PDF redirector link to 'ttraff.com' and a PDF SEO link farm. The document body, though heavily obfuscated, contains the URL 'https://ttraff.com/wix?keyword=jean+keating+prison+treatise', which is flagged as malicious. The heuristics 'SE_INVOICE_LURE', 'SE_ADVANCE_FEE_SCAM_LURE', and 'SE_CALLBACK_LURE' strongly suggest the document is designed to trick users into clicking malicious links or engaging in a scam, likely to facilitate further compromise or financial fraud.

Heuristics 6

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=jean+keating+prison+treatise
    • https://static.usrfiles.com/ugd/b8c837_5bea4a461d9d497e95025f9ffc078a22.pdf
    • https://static.usrfiles.com/ugd/b8c837_6b3c28caa47b4b82a743482ddadeec86.pdf
    • https://static.usrfiles.com/ugd/b8c837_0a031d5f108b4b9387e444886ff409b7.pdf
    • https://static.usrfiles.com/ugd/b8c837_e46635d64f244134a53be0cee9b98566.pdf
    • https://static.usrfiles.com/ugd/b8c837_1ee47d256e764390bb80a568278c3939.pdf
    • https://static.usrfiles.com/ugd/b8c837_781a18d74bd84e11ba27ce68396c5e62.pdf
    • https://static.usrfiles.com/ugd/b8c837_ff964ecc5c6241fba6fa20a46507a5d5.pdf
    • https://static.usrfiles.com/ugd/b8c837_6269df8c38474704b9020af4bb0b4d61.pdf
    • https://static.usrfiles.com/ugd/b8c837_aabc427c43f2495bb4eb577199b2d6a7.pdf
    • https://static.usrfiles.com/ugd/b8c837_7de014100b8241b9abae2cccd0627259.pdf
    • https://static.usrfiles.com/ugd/b8c837_397934fdb0bc4497ae15eef37ee9d19f.pdf
    • https://static.usrfiles.com/ugd/b8c837_e810887798344cc2be36d688afd827bc.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00017e54.bin
63c76c440c3ff04de9c13fef5abbcfd681572e95f3471f79b059fb8eeb79a582		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17E54 5008 bytes
font_01_sfnt_off00018f72.bin
095505570c08f5a67279b3d222aedf643c213e7781f12bec05b87c67dc6fd724		 pdf-font-stream PDF embedded font (sfnt) at offset 0x18F72 11004 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.