Malicious PDF — malware analysis report

Static analysis result for SHA-256 39cd5714d20319bb…

MALICIOUS

PDF

71.6 KB Created: 2020-07-20 21:10:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 515fda5674ed8a86e01ae587980232b0 SHA-1: 4091dbd2b206f978f4f1c00d3e28d936d49105a4 SHA-256: 39cd5714d20319bb4b9353c0192f9299e75499498b1c5257f04c663c6d602124
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a link farm and a malicious redirector URL, indicating a phishing or scam attempt. The document body, though heavily obfuscated, suggests a lure related to educational material. The primary malicious URL is ttraff.cc, which redirects to other content. The presence of numerous links hosted on cdn.shopify.com suggests a large-scale SEO poisoning or link farm operation.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=introduction+to+differential+and+integral+calculus+pdf
    • http://files.wastegyalstyles.com/uploads/1/3/0/8/130814126/wumujod-jewisomebenumad.pdf
    • http://files.puresculptbeauty.com/uploads/1/3/1/4/131406717/dc1409c5c2a.pdf
    • http://files.dallasapwu.org/uploads/1/3/0/7/130775071/705ed01bac.pdf
    • http://files.en.legrosorteil.com/uploads/1/3/2/7/132740805/3e31103.pdf
    • http://files.jemdesignz.com/uploads/1/3/1/4/131438583/d0ad087.pdf
    • https://cdn.shopify.com/s/files/1/0435/1338/1028/files/babojexinumomami.pdf
    • https://cdn.shopify.com/s/files/1/0434/3706/4344/files/97775520975.pdf
    • https://cdn.shopify.com/s/files/1/0429/3342/0195/files/41015473030.pdf
    • https://cdn.shopify.com/s/files/1/0432/2187/6900/files/38895322130.pdf
    • https://cdn.shopify.com/s/files/1/0431/9939/8052/files/jitizezosuxifanebijarugef.pdf
    • https://dirokuw.files.wordpress.com/2020/07/13124245975.pdf
    • https://xuxosasi.files.wordpress.com/2020/06/61320167972.pdf
    • https://fokewofupipi.files.wordpress.com/2020/07/jofuvuwibotibisupimaz.pdf
    • https://vawofomije194917598.files.wordpress.com/2020/06/memiv.pdf
    • https://cdn.shopify.com/s/files/1/0431/6754/7546/files/pejonakulejizi.pdf
    • https://cdn.shopify.com/s/files/1/0434/0862/1719/files/92395423531.pdf
    • https://cdn.shopify.com/s/files/1/0432/2567/7982/files/sidetelox.pdf
    • https://cdn.shopify.com/s/files/1/0430/9513/0266/files/ladusoso.pdf
    • https://cdn.shopify.com/s/files/1/0433/2437/5194/files/98611671877.pdf
    • https://cdn.shopify.com/s/files/1/0428/4848/5535/files/falezovukasuxaxim.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/72274594547.pdf
    • https://cdn.shopify.com/s/files/1/0429/3004/5084/files/79395843240.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ba94.bin
90595bb5f641362c193dba81475b6efa89a26cc1c4a60c3f05239389f16ad1ea		 pdf-font-stream PDF embedded font (sfnt) at offset 0xBA94 5144 bytes
font_01_sfnt_off0000cc1c.bin
ae7af74e17318039da09ced21c6f9ad0df96699f5639a092c35bf38306e66e00		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCC1C 14384 bytes
font_02_sfnt_off0000fa2f.bin
f7f944af48a1f29a4fc81369acbb7667dc0c0bb312d09d0e658341ed730dbf86		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFA2F 16144 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.