Malicious PDF — malware analysis report

Static analysis result for SHA-256 fdc99a6fa8edae15…

MALICIOUS

PDF

38.3 KB Created: 2020-09-07 02:38:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9456906429775cbba4025fe2a6eaf52b SHA-1: 4dff81ac5e1159307a86f215278e73f2a63e092f SHA-256: fdc99a6fa8edae157e7b096abdb09a7394670c4e3ec54fa9f3777daa922d34e3
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, many of which point to a domain identified as a malicious redirector. The document body, though heavily obfuscated, contains the URL 'https://ttraff.club/wix?keyword=telefonos+android+mercado+libre+caracas', suggesting a lure related to product sales. The presence of a link farm and a malicious redirector indicates an attempt to lead the user to a malicious site.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/wix?keyword=telefonos+android+mercado+libre+caracas
    • https://static.usrfiles.com/ugd/ad2ade_43ef1b2089c242d49cb76433f654e76f.pdf
    • https://static.usrfiles.com/ugd/607883_ef15120e92db41f3838a4b3223aadcc7.pdf
    • https://static.usrfiles.com/ugd/0b46e6_75829c5550e24e1a81cbfd9e1a1d4546.pdf
    • https://static.usrfiles.com/ugd/3db607_76bd3698995c458c9bd09e619ba36577.pdf
    • https://static.usrfiles.com/ugd/a8cc01_cd1f11bd83fc480ca4e158612ce88ac1.pdf
    • https://static.usrfiles.com/ugd/0e9fc2_fff1d148b9654e0382fb9a1c2224af64.pdf
    • https://static.usrfiles.com/ugd/764aaa_124c9e6bb2c34ccc9ef76b9f611b827d.pdf
    • https://static.usrfiles.com/ugd/88a84f_24da0c4b19984be8b36de7ce7c6b3f60.pdf
    • https://static.usrfiles.com/ugd/270e53_505f7b10718e4d28a0cbe87bdd2a234c.pdf
    • https://static.usrfiles.com/ugd/097bd5_6fbd759e6da64b40b65fe81f1aef249b.pdf
    • https://static.usrfiles.com/ugd/1c8c6c_62a00c2de0764378984503cb2e12e618.pdf
    • https://static.usrfiles.com/ugd/754d94_84b2d2286cb448cea30e66ca86b13e48.pdf
    • https://static.usrfiles.com/ugd/b4a829_5c46b10d27004284a34175174d656560.pdf
    • https://static.usrfiles.com/ugd/b8c837_823f16bd4e6a43ed96410974cb865342.pdf
    • https://static.usrfiles.com/ugd/fa6f14_93ae059fd6574a948a6d1e87e5986d9b.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000049d1.bin
ec044a14468886ac1cf7efbdd37410165977864fb94ea02e519720db321e5b29		 pdf-font-stream PDF embedded font (sfnt) at offset 0x49D1 4964 bytes
font_01_sfnt_off00005a91.bin
216aafb3b0c71fd3ab633643a65f10e4f0b99d1ef94c3b388dba207da0cc84f4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5A91 10296 bytes
font_02_sfnt_off00007dc9.bin
0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7DC9 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.