Malicious PDF — malware analysis report

Static analysis result for SHA-256 4f16dc3b893199a9…

MALICIOUS

PDF

44.9 KB Created: 2020-08-29 23:43:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 461d2808c5e00873f3444b3859ca6a29 SHA-1: 5eb8ddfbfb2fc4136c94577c30f3c0609e8f7bba SHA-256: 4f16dc3b893199a976d4b7f1c5ffc3816c58c2b0ec4aa91819a75fed69dda4b0
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'ttraff.club'. Additionally, it exhibits a PDF SEO link farm heuristic, with numerous links to Shopify-hosted PDFs. The document body, though heavily garbled, contains the URL 'https://ttraff.club/wix?keyword=ultech+digital+photo+frame', suggesting a lure related to a digital photo frame. The primary attack pattern involves redirecting users to malicious sites.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/wix?keyword=ultech+digital+photo+frame
    • https://cdn.shopify.com/s/files/1/0431/9854/6084/files/pidugiweb.pdf
    • https://cdn.shopify.com/s/files/1/0432/0778/6657/files/24509839124.pdf
    • https://cdn.shopify.com/s/files/1/0436/0352/5794/files/facing_death_and_the_life_after.pdf
    • https://static.usrfiles.com/ugd/b8c837_56dd455462e7419abe3af69b4c9d6f31.pdf
    • https://static.usrfiles.com/ugd/a18aa6_e1ae3dc1ed8e41c6a883199cca4a34b1.pdf
    • https://static.usrfiles.com/ugd/49be48_9abf1e21724c48099dcfd6fa2813229f.pdf
    • https://static.usrfiles.com/ugd/d775a9_71b91fec57584d0c9b1536ece1b96491.pdf
    • https://static.usrfiles.com/ugd/77d535_16387a36a8d84f689c0811e9645b606e.pdf
    • https://static.usrfiles.com/ugd/b8c837_39e4fce23e094c38b95c59222cf2cbd7.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/risekumomivedopela.pdf
    • https://cdn.shopify.com/s/files/1/0440/9291/5864/files/zolaxuzevikerenegiw.pdf
    • https://cdn.shopify.com/s/files/1/0430/9201/7305/files/8803685969.pdf
    • https://cdn.shopify.com/s/files/1/0429/3217/5014/files/chemistry_textbook_pearson.pdf
    • https://cdn.shopify.com/s/files/1/0432/9370/4356/files/zepika.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007266.bin
c879846b43b20aaa5587acecbbb4eeab122c0b2a67bbebb309a8932ef0908aa3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7266 5384 bytes
font_01_sfnt_off0000848e.bin
7127ee6d40eb90fbbde01f7d50886df214708212337e59dd073f8a2cccc69215		 pdf-font-stream PDF embedded font (sfnt) at offset 0x848E 10004 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.