Malicious PDF — malware analysis report

Static analysis result for SHA-256 3731952668ab73a5…

MALICIOUS

PDF

53.0 KB Created: 2020-08-22 11:05:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3da293efb0563d8da39689df22021081 SHA-1: 7631d68fa6b475e8981fdc6073d76a6deed127dd SHA-256: 3731952668ab73a590f80396fedfed7de799ff18e0d0a002f21322bf6e858953
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a significant number of embedded URLs, with a critical heuristic firing indicating a link farm and a malicious redirector. The primary malicious URL identified is https://ttraff.com/pify?keyword=key+informant+approach+%25E4%25B8%25AD%25E6%2596%2587, which is likely used to lure users to malicious content. The presence of numerous links, including those hosted on cdn.shopify.com, suggests an attempt to manipulate search engine results or distribute malicious content through a large number of seemingly benign documents.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=key+informant+approach+%25E4%25B8%25AD%25E6%2596%2587
    • http://files.thesettlementclinic.ca/uploads/1/3/0/7/130776131/4930f077e39d15.pdf
    • https://cdn.shopify.com/s/files/1/0429/5714/4230/files/pejek.pdf
    • https://cdn.shopify.com/s/files/1/0437/2715/9448/files/casio_fx_991ex_user_manual.pdf
    • https://cdn.shopify.com/s/files/1/0428/8049/9879/files/73776105963.pdf
    • https://cdn.shopify.com/s/files/1/0428/3331/3958/files/anemia_in_pregnancy_management.pdf
    • https://cdn.shopify.com/s/files/1/0427/4572/5094/files/89367857357.pdf
    • https://cdn.shopify.com/s/files/1/0431/3264/9636/files/github_gist_api.pdf
    • https://cdn.shopify.com/s/files/1/0427/9320/5916/files/potinib.pdf
    • https://cdn.shopify.com/s/files/1/0431/4087/4408/files/37977082124.pdf
    • https://cdn.shopify.com/s/files/1/0430/3316/5986/files/gegetibemugudumi.pdf
    • https://cdn.shopify.com/s/files/1/0432/7541/9798/files/capital_markets_interview_questions_and_answers.pdf
    • https://cdn.shopify.com/s/files/1/0433/9925/0081/files/39410533142.pdf
    • https://cdn.shopify.com/s/files/1/0429/5114/7679/files/fundamentals_of_electrical_electronics_engineering.pdf
    • https://cdn.shopify.com/s/files/1/0428/7945/1295/files/essentials_of_cardiopulmonary_physical_therapy_hillegass.pdf
    • https://cdn.shopify.com/s/files/1/0431/6463/1189/files/25810340196.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000689b.bin
98620f318d073503a79a86324f044f1b5802e9f84584378f0625e528bc987cf6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x689B 6176 bytes
font_01_sfnt_off00007d28.bin
fce10559d27a2bc7b88937375f87b86e2ac2cf502ec29b63cb520b9ab6b826d2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7D28 3112 bytes
font_02_sfnt_off0000882d.bin
bbc63b966bd2f899ff9292df7c360452fbb09b1f6b420348c72a773afb1db21a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x882D 5116 bytes
font_03_sfnt_off00009977.bin
6d123e5b8e98e3462dfe043df7343d4f7afb3da88eac62a8462273b9c4e4f959		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9977 13600 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.