Malicious PDF — malware analysis report

Static analysis result for SHA-256 4e4a806efdd2a6ec…

MALICIOUS

PDF

43.3 KB Created: 2020-08-29 19:47:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 510a2bf61281d1a628353e18ea9e38d2 SHA-1: 79b2246fcdb65ca3f9b731bfe7fe3c73e42dec88 SHA-256: 4e4a806efdd2a6ec16f6f1948ae59d7bc662cbe197eb044c64583a3bdad99ec9
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains numerous embedded links, a common tactic for SEO poisoning and redirecting users to malicious sites. One critical heuristic identified a link to a known malicious redirector, ttraff.com, which is disguised as typing exercises for children. The document body confirms this lure. The file also contains a large number of links to static.usrfiles.com and cdn.shopify.com, suggesting a link farm for SEO manipulation.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=ejercicios+de+mecanografia+para+ni%25C3%25B1o
    • https://static.usrfiles.com/ugd/b8c837_1ea06ee8763242819b6ad57a77c297b8.pdf
    • https://static.usrfiles.com/ugd/b8c837_e5cd7b02488f4d298ef00202ec2908f0.pdf
    • https://static.usrfiles.com/ugd/daca0d_320a9687789648de9bec5235b2679491.pdf
    • https://cdn.shopify.com/s/files/1/0437/5488/1175/files/charlie_movie_in_isaidub.pdf
    • https://cdn.shopify.com/s/files/1/0433/8191/5802/files/48165757330.pdf
    • https://cdn.shopify.com/s/files/1/0429/7375/7603/files/causes_and_effects_of_globalisation.pdf
    • https://cdn.shopify.com/s/files/1/0431/9733/3664/files/miloviti.pdf
    • https://cdn.shopify.com/s/files/1/0434/1612/5590/files/47895249374.pdf
    • https://cdn.shopify.com/s/files/1/0428/4419/2935/files/demuzemivujotezalorovuf.pdf
    • https://cdn.shopify.com/s/files/1/0433/8581/5205/files/89889526278.pdf
    • https://cdn.shopify.com/s/files/1/0433/0110/9920/files/kajilolumewido.pdf
    • https://cdn.shopify.com/s/files/1/0436/0581/9555/files/78210850653.pdf
    • https://cdn.shopify.com/s/files/1/0441/2529/0648/files/piano_sheet_music_free_popular.pdf
    • https://cdn.shopify.com/s/files/1/0431/2167/2356/files/97853875151.pdf
    • https://cdn.shopify.com/s/files/1/0428/6247/7479/files/criminal_law_book_1_by_estrada.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006733.bin
a3213aee99d219b120f3b11b277531ff408b166e599feb683decab41427fabea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6733 5688 bytes
font_01_sfnt_off00007a3c.bin
a8f6d7d04218f376423435597c22b66b6d2e6e90741f95ae110da79cc431fcbf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7A3C 11028 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.