Malicious PDF — malware analysis report

Static analysis result for SHA-256 3aa9baa1f73d837d…

MALICIOUS

PDF

40.6 KB Created: 2020-09-03 22:17:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 473a4459641c8810567e8bdb95b0819e SHA-1: 28e680a364203db4548918b7491de8d6af84e801 SHA-256: 3aa9baa1f73d837da272ff4288e66a222a3163b579d246df06760927b9685285
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a heuristic firing for a malicious redirector link, specifically pointing to 'https://ttraff.link/wix?keyword=daily+jumble+puzzle+answers'. This URL is presented within the document body, disguised as a link to 'daily jumble puzzle answers'. The file also exhibits characteristics of a PDF link farm, with numerous links to external PDFs hosted on Shopify. The primary malicious intent appears to be redirecting users to the malicious ttraff.link domain.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/wix?keyword=daily+jumble+puzzle+answers
    • https://cdn.shopify.com/s/files/1/0440/5172/6501/files/76936460791.pdf
    • https://cdn.shopify.com/s/files/1/0435/9841/3983/files/characteristics_of_postmodernism.pdf
    • https://cdn.shopify.com/s/files/1/0431/2514/5760/files/46896997086.pdf
    • https://cdn.shopify.com/s/files/1/0433/5144/1560/files/thermal_insulation_sheet_material.pdf
    • https://cdn.shopify.com/s/files/1/0431/6450/0122/files/59161251814.pdf
    • https://cdn.shopify.com/s/files/1/0428/7981/1750/files/wordly_wise_3000_book_8_lesson_6_answer_key.pdf
    • https://cdn.shopify.com/s/files/1/0429/6926/8383/files/83056488605.pdf
    • https://cdn.shopify.com/s/files/1/0429/4357/8278/files/94070923712.pdf
    • https://cdn.shopify.com/s/files/1/0469/0070/7490/files/day_off_keto_diet.pdf
    • https://cdn.shopify.com/s/files/1/0434/4145/5256/files/90912288406.pdf
    • https://cdn.shopify.com/s/files/1/0432/7368/3100/files/jogal.pdf
    • https://cdn.shopify.com/s/files/1/0439/5322/5883/files/equilibrio_acido_base_ejercicios_resueltos.pdf
    • https://cdn.shopify.com/s/files/1/0430/6727/7469/files/xelurazotajefisizekuju.pdf
    • https://cdn.shopify.com/s/files/1/0432/8102/3132/files/salesforce_scenario_based_interview_questions_and_answers.pdf
    • https://cdn.shopify.com/s/files/1/0441/1945/7944/files/hospital_alta_complejidad_formosa_numero_telefono.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005fea.bin
6576f1d5a330b2dc05e6135c4f488a01f0ce7244662cb30848684a9fc3d3875a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5FEA 5424 bytes
font_01_sfnt_off00007268.bin
5302e874a41faad0cf617c0e9a9204e39566d20028b7dbfbabc9824b4e1cfed7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7268 10272 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.