Malicious PDF — malware analysis report

Static analysis result for SHA-256 43a84bede49834c4…

MALICIOUS

PDF

40.9 KB Created: 2020-08-31 05:55:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 408ac505e76396a5ab455929741e4282 SHA-1: 5dd7507fdfb3443238b81525293dada6a4f9ad70 SHA-256: 43a84bede49834c4ebd45a378fa574d28576fdbacd88d7913ef04600764f2d4e
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a critical heuristic firing for a malicious redirector link, specifically pointing to 'https://ttraff.link/wix?keyword=50+shades+of+grey+for+free'. The document body, though heavily obfuscated, contains text related to '50 shades of grey for free', suggesting a lure. The PDF also contains a large number of external links, many pointing to Shopify domains, indicating a link farm strategy. The primary malicious IOC is the ttraff.link redirector.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/wix?keyword=50+shades+of+grey+for+free
    • https://cdn.shopify.com/s/files/1/0438/0773/5969/files/romeo_and_juliet_act_1_packet_answers.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/zotogobujadafozafinuv.pdf
    • https://cdn.shopify.com/s/files/1/0431/6862/8892/files/xegebozegebagi.pdf
    • https://cdn.shopify.com/s/files/1/0428/1214/5830/files/98132854252.pdf
    • https://static.usrfiles.com/ugd/fb83f1_4b633311da734da7bbb71ceffeb22546.pdf
    • https://static.usrfiles.com/ugd/7f16bd_1f120a1cc4df44e18ab6f4cf4e5be944.pdf
    • https://static.usrfiles.com/ugd/5ecadc_f38f75dbf9ea4318a5ffe2b2a7bab242.pdf
    • https://static.usrfiles.com/ugd/44b221_8e44a92e931f4f95be66429f5207a3f4.pdf
    • https://static.usrfiles.com/ugd/6f58fb_ca1ef0a3a65e4035b3a643888b713f7a.pdf
    • https://static.usrfiles.com/ugd/9219f8_7355229686a548a0a7436ca767ba530e.pdf
    • https://static.usrfiles.com/ugd/93971e_6650e89c54ca455aa994cdb777884cfa.pdf
    • https://static.usrfiles.com/ugd/07e02c_4bc903bdc27243ae80154ee046ac958d.pdf
    • https://static.usrfiles.com/ugd/19103d_3b2f5cdaed2d441dbe9540c1e6289ec1.pdf
    • https://cdn.shopify.com/s/files/1/0434/9663/6580/files/bsh_guidelines_polycythaemia.pdf
    • https://cdn.shopify.com/s/files/1/0430/7845/1351/files/27173230453.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000620a.bin
e34e562b4fd908db8f133811ab1b68c043ea23e0c4a30f7503046c7989e69641		 pdf-font-stream PDF embedded font (sfnt) at offset 0x620A 5408 bytes
font_01_sfnt_off0000746f.bin
c8b32786bcf55717e22c530d5603f6c81ce2b751d264d566c025f6a17c6786c2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x746F 10144 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.