Malicious PDF — malware analysis report

Static analysis result for SHA-256 2108b9d844b3d421…

MALICIOUS

PDF

45.7 KB Created: 2020-08-11 09:31:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3fdd09d1598b34b594d83f63b54aaeda SHA-1: cb88137971e07d9ad9cba0804ac4792ddf8fd022 SHA-256: 2108b9d844b3d421128dfcf675bc7a40c3c480e32f11f25c71d3258d8e7ff2f3
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a link farm designed to mimic search engine results, with a primary malicious redirector link. The document body, though heavily obfuscated, contains the text 'Non editable pdf to word converter online' and the malicious URL 'https://ttraff.cc/pify?keyword=non+editable+pdf+to+word+converter+online', suggesting a lure to a malicious site. The presence of numerous links to Shopify-hosted PDFs indicates an attempt to create a large, SEO-optimized link farm for malicious redirection.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=non+editable+pdf+to+word+converter+online
    • http://files.inspiredbyqueens.org/uploads/1/3/1/6/131606874/kovotalave_fakefelakumedu_mokadodupimulox.pdf
    • http://bifamad.l1goalkeeper.com/uploads/1/3/0/7/130775634/6476114.pdf
    • http://files.threeatlantacats.com/uploads/1/3/2/7/132740307/vifomolegoxaka.pdf
    • https://cdn.shopify.com/s/files/1/0431/0004/5469/files/dazumedejoniwaf.pdf
    • https://cdn.shopify.com/s/files/1/0438/5921/4501/files/minecraft_place_block_command.pdf
    • https://cdn.shopify.com/s/files/1/0434/0885/1098/files/zapaxeratiluwozi.pdf
    • https://cdn.shopify.com/s/files/1/0431/8514/3965/files/niwovakuzebini.pdf
    • https://cdn.shopify.com/s/files/1/0439/4047/9144/files/37932203442.pdf
    • https://cdn.shopify.com/s/files/1/0433/8342/3128/files/77667456917.pdf
    • https://cdn.shopify.com/s/files/1/0439/1727/9400/files/bitekene.pdf
    • https://cdn.shopify.com/s/files/1/0430/3942/4669/files/pirojavadalogaparaguta.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/mozinetesabelenigifil.pdf
    • https://cdn.shopify.com/s/files/1/0429/3220/7782/files/classroom_jobs_application.pdf
    • https://cdn.shopify.com/s/files/1/0431/6545/0389/files/research_terminology_simplified_paradigms_axiology_ontology_epistemology_and_methodology.pdf
    • https://cdn.shopify.com/s/files/1/0428/6421/4182/files/15817421096.pdf
    • https://cdn.shopify.com/s/files/1/0429/0061/9423/files/dozaxufabavobetawovos.pdf
    • https://cdn.shopify.com/s/files/1/0437/5465/1799/files/on_his_blindness_summary_download.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006697.bin
b8d95e492e1df8ef7c871e3e8b7f148eec0fe8143128fe1b80ff6d0aa263f93f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6697 5020 bytes
font_01_sfnt_off000077ca.bin
41bfaa45022dfe81156ed918f0e201295e362b9db92bf689d21e193a16413b3d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x77CA 10332 bytes
font_02_sfnt_off00009b14.bin
1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9B14 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.