Malicious PDF — malware analysis report

Static analysis result for SHA-256 fc1f8272445298e9…

MALICIOUS

PDF

80.5 KB Created: 2020-09-09 20:43:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 421efd3780e8c9b0e8a2e697de64f477 SHA-1: b3288ab14506c15800e2ee284f358038b9881556 SHA-256: fc1f8272445298e98384e7d18d700afda24c876720e664db24c36c54a2dbec6a
120 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.002 Spearphishing Attachment

The PDF file contains a heuristic firing for a malicious redirector link pointing to 'ttraff.com'. Additionally, it exhibits characteristics of a PDF link farm, with numerous links hosted on 'static.usrfiles.com'. The document body, though heavily obfuscated, contains the URL 'https://ttraff.com/wb?keyword=fibra%20optica%20funcionamiento%20pdf', suggesting a lure related to fiber optics to entice clicks to malicious infrastructure.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wb?keyword=fibra%20optica%20funcionamiento%20pdf
    • https://static.usrfiles.com/ugd/b910ae_248ebc37bf8a403ab448855411106a76.pdf
    • https://static.usrfiles.com/ugd/ca300b_d64b9c29e9d5439a99d8a5b9c3c3ea24.pdf
    • https://static.usrfiles.com/ugd/b8c837_efab7b681d9a43dfa11e5b6b10af5f43.pdf
    • https://static.usrfiles.com/ugd/b8c837_f15f68f39dd847d28e77d2d128877ca4.pdf
    • https://static.usrfiles.com/ugd/c1108c_8833db3ca19d4348b60d03f1a02233ba.pdf
    • https://static.usrfiles.com/ugd/278743_10c6d0094d28432abd75061bca9d6ae7.pdf
    • https://static.usrfiles.com/ugd/e643da_d54bbf4cedec4a229f4fe4653d6b3e11.pdf
    • https://static.usrfiles.com/ugd/90423f_b42c0132fbca4418844cfdeada931b04.pdf
    • https://static.usrfiles.com/ugd/b5973a_098d7da3c35b47e79c8ade871447a2c3.pdf
    • https://static.usrfiles.com/ugd/34ec99_978a172064d14665823e18a269d43b96.pdf
    • https://static.usrfiles.com/ugd/b27199_33a1a45c94474be994cbf3ff5594c070.pdf
    • https://static.usrfiles.com/ugd/b8c837_41b48aa537b34ad0b8e4dbd666fb291f.pdf
    • https://static.usrfiles.com/ugd/1acd69_b90496f35c6f47bb90c41c2bee099227.pdf
    • https://static.usrfiles.com/ugd/99afdc_a0671f4e999d44f8a9bcbb5bf4a1d301.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fb3e.bin
08344b5dbc39b6e58c57dd740651d6259f44e5cf00aafe8227bda23a6b7ae977		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFB3E 5188 bytes
font_01_sfnt_off00010ccc.bin
e2af63ac382c9e375e9ff2d6729fdf3a232aa2a8e78dd1a8c93faa120f6cee0a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10CCC 11840 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.