Malicious PDF — malware analysis report

Static analysis result for SHA-256 2c882cb859569659…

MALICIOUS

PDF

52.5 KB Created: 2020-08-23 08:21:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 82d04e2f65fa392000d4e7563367d812 SHA-1: b63a9539b2ca81d882453aacb73b505d3a6e1c75 SHA-256: 2c882cb8595696599d62ccfb4f0efa12bee43d4ecc44cc44eb120da5b52e6e4a
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a lure for a 'budget increase proposal template' which, upon clicking, redirects the user to malicious infrastructure via the URL https://ttraff.cc/pify?keyword=budget+increase+proposal+template. The file also exhibits characteristics of a link farm, embedding numerous external PDF links, many of which point to benign Shopify domains but some to unknown domains that could host further malicious content. No scripts were extracted from this sample, limiting the analysis of its direct execution behavior.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=budget+increase+proposal+template
    • http://muxima.riggsmainecooncattery.com/uploads/1/3/1/6/131606490/tafabasuxa_tubunuvaputesiv.pdf
    • http://files.laurabain.com.au/uploads/1/3/2/8/132815342/jevotiwa.pdf
    • http://pufasob.mountcrosscdc.com/uploads/1/3/1/8/131856877/5f51b82.pdf
    • http://files.antennabooks.com/uploads/1/3/0/7/130776828/pinopiviputurubegi.pdf
    • http://files.hosannadance.com/uploads/1/3/1/4/131406068/wepetozem.pdf
    • https://cdn.shopify.com/s/files/1/0428/2174/6847/files/jusewisopulagubobavex.pdf
    • https://cdn.shopify.com/s/files/1/0440/4301/0198/files/85218453433.pdf
    • https://cdn.shopify.com/s/files/1/0439/5086/6590/files/83307010138.pdf
    • https://cdn.shopify.com/s/files/1/0431/1266/1152/files/27037278086.pdf
    • https://cdn.shopify.com/s/files/1/0428/8564/4447/files/appraisal_form_meaning.pdf
    • https://cdn.shopify.com/s/files/1/0434/6806/2872/files/92326589153.pdf
    • https://cdn.shopify.com/s/files/1/0433/3672/8734/files/garden_answer_planting_bulbs.pdf
    • https://cdn.shopify.com/s/files/1/0447/5705/7687/files/gajalipizejat.pdf
    • https://cdn.shopify.com/s/files/1/0433/9780/8285/files/45255303394.pdf
    • https://cdn.shopify.com/s/files/1/0440/5025/1941/files/lededanasexolufagi.pdf
    • https://cdn.shopify.com/s/files/1/0435/6482/6773/files/ethical_behaviour_in_the_workplace.pdf
    • https://cdn.shopify.com/s/files/1/0430/9454/0439/files/fotukidirawelenipobu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000084d7.bin
aa7f0ee3fa5000b7ce2edf4620fecaa61939867362b4c19e9697df7bc60e4ae5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x84D7 5440 bytes
font_01_sfnt_off00009734.bin
2b17894289ef4ac549ca5ccbfe538e6ebde94701791c0542cba9a71f2d67f349		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9734 2268 bytes
font_02_sfnt_off0000a147.bin
a4b25e3ffbbecbd9bd9d4d81cf21aa00b7b9a62d790e6cc96716c885569d8c7f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA147 10364 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.