Malicious PDF — malware analysis report

Static analysis result for SHA-256 1f1acb8177c22789…

MALICIOUS

PDF

43.4 KB Created: 2020-08-05 17:12:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4fa56ebd5744cbab7bda4cd798f30c45 SHA-1: 48d5119503805b3e27745799d0c26f782900cc60 SHA-256: 1f1acb8177c22789bd2ff6590bb4e99ba306796eb812f7bc5b7995b0d61c1240
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains numerous embedded links, with a critical heuristic identifying a malicious redirector. The document body, though garbled, contains text suggesting a lure related to translation exercises. The primary malicious URL, https://ttraff.com/pify?keyword=t%25C5%2582umaczenie+zda%25C5%2584+angielski+%25C4%2587wiczenia+pdf, is likely used to redirect the user to a phishing or malware download site. The presence of many links to Shopify-hosted PDFs suggests a link farm for SEO poisoning or traffic generation.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=t%25C5%2582umaczenie+zda%25C5%2584+angielski+%25C4%2587wiczenia+pdf
    • http://files.ullrichsstore.com/uploads/1/3/1/3/131380213/tigowuvopi.pdf
    • http://files.microbesbymarco.com/uploads/1/3/1/6/131606201/gajabo.pdf
    • http://files.adamkentlegal.com/uploads/1/3/2/7/132740951/6fe4625.pdf
    • http://files.dontbeacrashtestdummy.com/uploads/1/3/1/3/131380845/xumuruz.pdf
    • http://files.georgeatwood.com/uploads/1/3/1/4/131438641/piwode_vanogafafiliket_xanowaxaba_gemem.pdf
    • https://cdn.shopify.com/s/files/1/0435/1646/1211/files/pawineriti.pdf
    • https://cdn.shopify.com/s/files/1/0439/7786/7422/files/zoxovif.pdf
    • https://cdn.shopify.com/s/files/1/0433/8001/5262/files/pilajiluked.pdf
    • https://cdn.shopify.com/s/files/1/0430/2484/2906/files/93854690940.pdf
    • https://cdn.shopify.com/s/files/1/0434/4542/0188/files/41926749738.pdf
    • https://cdn.shopify.com/s/files/1/0431/9805/4558/files/solabupojazebexawo.pdf
    • https://cdn.shopify.com/s/files/1/0440/5238/1846/files/64316820720.pdf
    • https://cdn.shopify.com/s/files/1/0427/5834/0774/files/5912915316.pdf
    • https://cdn.shopify.com/s/files/1/0427/8901/1612/files/95066442568.pdf
    • https://cdn.shopify.com/s/files/1/0434/8080/9625/files/50269103531.pdf
    • https://cdn.shopify.com/s/files/1/0428/2771/0630/files/70964931132.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/92161478626.pdf
    • https://cdn.shopify.com/s/files/1/0432/9360/6048/files/espn_go_com_nhl_scoreboard.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006660.bin
a949013a36db082c6b37b8869097df89ca6866d2088627cb3c82c84da262e5a9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6660 5856 bytes
font_01_sfnt_off000079df.bin
50fcbe9173130df9e2bd7c7153627f274d94b114b39a4af35bcf25a4b50c5457		 pdf-font-stream PDF embedded font (sfnt) at offset 0x79DF 11580 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.