Malicious PDF — malware analysis report

Static analysis result for SHA-256 2ac570919d213c59…

MALICIOUS

PDF

37.4 KB Created: 2020-08-30 10:52:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 562900307fc3884ca7fce551cfd88302 SHA-1: 8946b5a26c7a39236b8a6ec83f78ddd7beb07eb1 SHA-256: 2ac570919d213c59f21b341c00fbf22bac661b592737f4861f80e731045ab8a8
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.com/wix?keyword=the+asphalt+handbook'. Additionally, it exhibits characteristics of a PDF link farm, embedding numerous external links, with the primary one being to a Shopify domain. The document body, though heavily obfuscated, contains references to the redirector URL and other PDF files hosted on Shopify. This suggests a social engineering attack aiming to redirect users to malicious content.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=the+asphalt+handbook
    • https://cdn.shopify.com/s/files/1/0432/6876/7912/files/mukazekarizovif.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/zonamanasalusowalu.pdf
    • https://cdn.shopify.com/s/files/1/0429/4665/8463/files/acidosis_respiratoria_y_metabolica.pdf
    • https://cdn.shopify.com/s/files/1/0431/6971/0242/files/the_collapse_of_the_roman_empire.pdf
    • https://cdn.shopify.com/s/files/1/0431/7980/2782/files/dictionnaire_juridique_anglais_francais.pdf
    • https://static.usrfiles.com/ugd/b8c837_aa573429fb52486d9ceffad07794d9fb.pdf
    • https://static.usrfiles.com/ugd/b56239_b7d8ba586112479fb44905d3dc63ea4f.pdf
    • https://static.usrfiles.com/ugd/b8c837_22813a1d775f470e99dea0f87da2c60b.pdf
    • https://static.usrfiles.com/ugd/a382ee_38c5eb448ec94145b11346ed731877e1.pdf
    • https://static.usrfiles.com/ugd/b8c837_f0ebfcabce4c4cf0a162a5a8fcf1f344.pdf
    • https://static.usrfiles.com/ugd/b8c837_d7a5154abc534d9fb684c0cba3385b6e.pdf
    • https://cdn.shopify.com/s/files/1/0433/4085/7494/files/805830081.pdf
    • https://cdn.shopify.com/s/files/1/0432/3019/9966/files/reading_and_writing_skills_grade_11_deped.pdf
    • https://cdn.shopify.com/s/files/1/0432/7306/0520/files/71636223803.pdf
    • https://cdn.shopify.com/s/files/1/0432/2371/1903/files/vezajafadokaxofit.pdf
    • https://cdn.shopify.com/s/files/1/0432/5782/3390/files/textbook_of_diagnostic_microbiology_mahon_free_download.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000047f9.bin
32847a58d75b6f5bc5280163fe86c6c5a221666ce4ec0f94b531c255f98714e2
pdf-font-stream PDF embedded font (sfnt) at offset 0x47F9 4844 bytes
font_01_sfnt_off0000585e.bin
b4a6ffaa2fe11aac664343a1fec2ec8bfdc23a30a68e7b36a508da6374607901
pdf-font-stream PDF embedded font (sfnt) at offset 0x585E 10060 bytes
font_02_sfnt_off00007acc.bin
9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2
pdf-font-stream PDF embedded font (sfnt) at offset 0x7ACC 4324 bytes