Malicious PDF — malware analysis report

Static analysis result for SHA-256 27625e7b8826e9d2…

MALICIOUS

PDF

43.7 KB Created: 2020-08-18 22:55:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 44aec907f3a6c7dd73ce2284d2881206 SHA-1: 9815ab1f468c51f71ce15bc2c84eaf4c7673599e SHA-256: 27625e7b8826e9d285227ea324231974e8f2e60edb72f088ad099168f3e8a87e
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a heuristic firing for a malicious redirector link, specifically pointing to 'https://ttraff.cc/pify?keyword=answers+raw+dog+food+recall'. This URL is embedded within the document body, disguised as a recall notice. The file also contains a large number of external PDF links, many of which point to benign Shopify domains, but some point to unknown domains that could host further malicious content. The primary attack vector appears to be social engineering via a deceptive document, leading the user to a malicious redirector.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=answers+raw+dog+food+recall
    • http://kekok.lolalockettministries.com/uploads/1/3/0/9/130969600/roxezulokala.pdf
    • http://zujaler.shopverjus.com/uploads/1/3/0/9/130970009/bofibusofozorevu.pdf
    • https://cdn.shopify.com/s/files/1/0436/3229/6089/files/broadcasting_services_act_1992.pdf
    • https://cdn.shopify.com/s/files/1/0432/3488/5792/files/25394374513.pdf
    • https://cdn.shopify.com/s/files/1/0439/2674/9339/files/29569431083.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/pejuzesuloroxutebed.pdf
    • https://cdn.shopify.com/s/files/1/0433/7372/3800/files/47842156606.pdf
    • https://cdn.shopify.com/s/files/1/0430/9050/9973/files/82039196194.pdf
    • https://cdn.shopify.com/s/files/1/0431/8858/4605/files/dizilorok.pdf
    • https://cdn.shopify.com/s/files/1/0432/5870/8136/files/best_mod_manager_for_fallout_new_vegas.pdf
    • https://cdn.shopify.com/s/files/1/0434/2457/9751/files/kibovivojinagosirixux.pdf
    • https://cdn.shopify.com/s/files/1/0431/1754/3588/files/nezufepumov.pdf
    • https://cdn.shopify.com/s/files/1/0435/1731/3176/files/independent_and_dependent_variables_worksheet.pdf
    • https://cdn.shopify.com/s/files/1/0431/3638/5175/files/adiabatic_demagnetization_refrigerator.pdf
    • https://cdn.shopify.com/s/files/1/0429/0599/3375/files/xezitupetezu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006c1d.bin
5f09bc3d09a53df3cb670dec368200e1ef5caa04452586fb030886904140216a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6C1D 5268 bytes
font_01_sfnt_off00007e24.bin
fc9d217d725dc578a2ad18474a0d1c5a0f57ee3ae83ee91eb942c2454610c1b4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7E24 10524 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.