Malicious PDF — malware analysis report

Static analysis result for SHA-256 336abdccec7fcda3…

MALICIOUS

PDF

45.1 KB Created: 2020-09-01 10:36:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bb8fce7bf3c1af8907c95afe77e4c8cf SHA-1: 3cd4b47bea4dc7f96526e0019f99ae747ee46369 SHA-256: 336abdccec7fcda3524984217d44a11c3c29f4aed81752ca4d89152529a4c021
140 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a malicious redirector link pointing to 'ttraff.cc', which is flagged as malicious. Additionally, it exhibits characteristics of a link farm, embedding numerous external PDF links, many hosted on Shopify. The document body, though partially corrupted, contains the same malicious URL and hints at a callback lure context, suggesting a phishing or scam attempt. The primary attack vector appears to be tricking the user into clicking the malicious link.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=journal+entries+practice+problems+with+answers
    • https://cdn.shopify.com/s/files/1/0434/1871/4264/files/15528361578.pdf
    • https://cdn.shopify.com/s/files/1/0431/0958/0961/files/google_chrome_32_bit_windows_7.pdf
    • https://cdn.shopify.com/s/files/1/0433/0386/2440/files/xijixotiwejoxorazeduber.pdf
    • https://cdn.shopify.com/s/files/1/0440/9635/6504/files/razewufuloxofafakaki.pdf
    • https://cdn.shopify.com/s/files/1/0431/1236/6241/files/burial_rites.pdf
    • https://cdn.shopify.com/s/files/1/0440/2121/9493/files/lumujurizidatufovusitekuw.pdf
    • https://cdn.shopify.com/s/files/1/0433/8194/8567/files/mandala_art_designs.pdf
    • https://static.usrfiles.com/ugd/efb3f0_235158e937774925b651f30beafd973e.pdf
    • https://static.usrfiles.com/ugd/b8c837_14d8d984de324ca39cffe21bbbbdfa34.pdf
    • https://static.usrfiles.com/ugd/8c0e65_27336e4c763b49a299127e6101ccfdda.pdf
    • https://static.usrfiles.com/ugd/b8c837_4967be25dfe04a1fafee897d9a13e9fc.pdf
    • https://static.usrfiles.com/ugd/724bd4_3fc0f804eb2d4f1e9952502093b3408b.pdf
    • https://static.usrfiles.com/ugd/b56239_bdec86d347c34a04ac23a8a5abfbfd37.pdf
    • https://static.usrfiles.com/ugd/b8c837_8ccab66bbe3a4a7c8b252fca15e89c60.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000596d.bin
e001632011563582e76af016093ae77d9aa9f55335c5d31987baba0d8e2c9c70
pdf-font-stream PDF embedded font (sfnt) at offset 0x596D 5276 bytes
font_01_sfnt_off00006b33.bin
41e6bdca1c36f43a70d243bc1c4f7b87c6e735b1b3a3085eea8499c3e9120b02
pdf-font-stream PDF embedded font (sfnt) at offset 0x6B33 14648 bytes
font_02_sfnt_off00009952.bin
cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34
pdf-font-stream PDF embedded font (sfnt) at offset 0x9952 4324 bytes