Malicious PDF — malware analysis report

Static analysis result for SHA-256 32110d34020e6612…

MALICIOUS

PDF

262.7 KB Created: 2020-09-18 20:28:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e8fe7f32daf0ec20d3bba74d73ec8e37 SHA-1: 36587951a2589ae9a6535150a5d9224a6f485c9e SHA-256: 32110d34020e661299b26244c009206acc8d4fa0ccbdf33e87b9b6393aba6c58
70 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a heuristic firing for a malicious redirector link, pointing to 'https://ttraff.cc/wb?keyword=9th%20grade%20vocabulary%20words%20list'. The document body, though heavily obfuscated, appears to contain the same URL and a title related to '9th grade vocabulary words list', suggesting a lure to trick users into clicking the malicious link. The file's purpose is to redirect users to a potentially harmful website.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wb?keyword=9th%20grade%20vocabulary%20words%20list
    • https://cdn.shopify.com/s/files/1/0435/5099/8679/files/sahih_bukhari_francais.pdf
    • https://cdn.shopify.com/s/files/1/0436/1850/0765/files/american_technology_services_reviews.pdf
    • https://cdn.shopify.com/s/files/1/0433/2063/9646/files/52729079798.pdf
    • https://cdn.shopify.com/s/files/1/0434/3840/7845/files/arkham_city_game_informer_review.pdf
    • https://473773e0-81f3-4a85-8551-c5e44d41b50b.filesusr.com/ugd/d4a9d6_b8c8db61884e4a2c845ba224734a6565.pdf?index=true
    • https://e1e02cbb-de5b-4e1c-b075-023dc28abcf9.filesusr.com/ugd/4c76bf_5d858c2b4e7b4379a526a9cb04b15685.pdf?index=true
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/46824776831.pdf
    • https://cdn.shopify.com/s/files/1/0435/4569/0266/files/telaju.pdf
    • https://cdn.shopify.com/s/files/1/0440/5208/6934/files/university_of_iowa_school_calendar_2020.pdf
    • https://cdn.shopify.com/s/files/1/0432/1515/9458/files/troy_bilt_2200_psi_pressure_washer_parts.pdf
    • https://cdn.shopify.com/s/files/1/0432/1473/3480/files/investigative_interview_techniques.pdf
    • https://cdn.shopify.com/s/files/1/0476/9506/9343/files/tidopibitirezifobima.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0003d6d1.bin
e72aea0b3e354cdca1cc61ba975ad7fb3aa77c2d5f41e5c6df093098e239de25		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3D6D1 5656 bytes
font_01_sfnt_off0003ea20.bin
46752b9dc6fadebe366d4f54220be9a11f84f0aadf476f6658edecc8526c2756		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3EA20 10164 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.