Malicious PDF — malware analysis report

Static analysis result for SHA-256 4499ae857d7e330e…

MALICIOUS

PDF

38.5 KB Created: 2020-08-31 23:58:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7c62d5f618e70bc955c827b8f60376bd SHA-1: 464f060195d73d19b9581eccdf34a8afbc26c5d5 SHA-256: 4499ae857d7e330e447ecef428082883708e3e0886b09dbbef73709fde290a1e
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a link farm pointing to numerous external PDF files, with one of the primary links leading to a known malicious redirector. The document body is heavily obfuscated and contains what appears to be a reconstructed URL, 'https://ttraff.com/pify?keyword=av+malformation+skin', which is flagged as malicious. This suggests a social engineering attempt to redirect the user to malicious content.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=av+malformation+skin
    • https://static.usrfiles.com/ugd/5926b4_06682d5844e242959c46e5bc843b0d62.pdf
    • https://static.usrfiles.com/ugd/b8c837_3c110e82de454fb2bef28a9e1e904a6a.pdf
    • https://static.usrfiles.com/ugd/b8c837_ed9871661708467aadf8c849b8467d8d.pdf
    • https://cdn.shopify.com/s/files/1/0435/1010/4216/files/81530656832.pdf
    • https://static.usrfiles.com/ugd/5e81b9_0c5d54d66f8d4c0a9f2df773ad06b5c9.pdf
    • https://static.usrfiles.com/ugd/b8c837_62918db86f814b9ab2c56ab61585f3c0.pdf
    • https://static.usrfiles.com/ugd/8d57bd_2f142296a33b426397dd36da4d3e3f53.pdf
    • https://static.usrfiles.com/ugd/d5415a_7b986b21f1c94750aba7f172438ddad8.pdf
    • https://static.usrfiles.com/ugd/39cb9d_35d431a0f50a439685e9b901ea1e003d.pdf
    • https://cdn.shopify.com/s/files/1/0435/9582/5320/files/binomial_theorem_examples.pdf
    • https://cdn.shopify.com/s/files/1/0427/9002/7430/files/african_belief_system.pdf
    • https://cdn.shopify.com/s/files/1/0437/7896/5656/files/rusunolugelesajar.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005aac.bin
a2db6e601b6fe54d521d89a17f24a7471a751af38b90e554f7ecadca513924eb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5AAC 5028 bytes
font_01_sfnt_off00006bb6.bin
e6fc05381351302b608c867d62d189af8f5e407bf4ba63bba448c248dda5477e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6BB6 10108 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.