Malicious PDF — malware analysis report

Static analysis result for SHA-256 210010a388484e9c…

MALICIOUS

PDF

43.5 KB Created: 2020-08-30 03:05:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5f1c3819973d08e20606345c461032e9 SHA-1: 7007048ff21a9967b9efee7cd6d8b4d44d6cda46 SHA-256: 210010a388484e9c05accda175c3b30d069243f4d67fe45d09da37c08988800b
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a critical heuristic firing for a malicious redirector link, specifically pointing to 'ttraff.cc'. This URL is likely part of a phishing or malware distribution chain. Additionally, the file exhibits characteristics of a link farm, with numerous embedded URLs, many hosted on Shopify. The document body, though heavily obfuscated, contains the same redirector URL and a Shopify URL, reinforcing the malicious intent. No scripts were extracted, and the document body does not provide further context beyond the embedded URLs.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=stranger+in+a+strange+land+uncut+ebo
    • https://cdn.shopify.com/s/files/1/0433/9793/9361/files/94346916962.pdf
    • https://cdn.shopify.com/s/files/1/0428/3914/6662/files/9903961160.pdf
    • https://cdn.shopify.com/s/files/1/0432/7541/9798/files/simple_addition_worksheets_fun.pdf
    • https://cdn.shopify.com/s/files/1/0432/0215/0557/files/74262221115.pdf
    • https://static.usrfiles.com/ugd/24853a_3c90cebf52454073b57ab652e54f76b0.pdf
    • https://cdn.shopify.com/s/files/1/0428/1466/8959/files/minecraft_eya_mod_1.7_10_9minecraft.pdf
    • https://cdn.shopify.com/s/files/1/0434/4138/9724/files/best_sense_of_humor_award_template.pdf
    • https://cdn.shopify.com/s/files/1/0430/8543/0945/files/dasupa.pdf
    • https://cdn.shopify.com/s/files/1/0429/6274/7545/files/4073086815.pdf
    • https://cdn.shopify.com/s/files/1/0440/9845/3656/files/causae_et_curae.pdf
    • https://cdn.shopify.com/s/files/1/0438/0393/4877/files/essentials_of_pathophysiology_concepts_of_altered_health_states_download.pdf
    • https://cdn.shopify.com/s/files/1/0435/9513/7181/files/national_osteoporosis_guidelines_uk.pdf
    • https://cdn.shopify.com/s/files/1/0430/6108/4314/files/92393568477.pdf
    • https://cdn.shopify.com/s/files/1/0435/6908/6623/files/65898956287.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006b77.bin
718dd1d2cddf18ab6b3a5dc49fb53142c7acf4224a042f20111c8bd7e9affb63		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6B77 5352 bytes
font_01_sfnt_off00007d9d.bin
15526c04c13d4deb9beef2968f27678d34f83b9ab80be826fa02e1f429e9c8c3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7D9D 10600 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.