Malicious PDF — malware analysis report

Static analysis result for SHA-256 52ad56dc996a8b16…

MALICIOUS

PDF

36.0 KB Created: 2020-08-30 16:17:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 59fc684cde2fbeae13443183f9b39c6d SHA-1: 5fadd8f8ab64b2a2a4e829404f8bcf60b35c2a64 SHA-256: 52ad56dc996a8b162de06754b73b70c78b1db00754d76e6c62af4954333b7a9f
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains numerous embedded links, with one pointing to a known malicious redirector (ttraff.com). The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of external PDF links, suggesting an attempt to manipulate search engine results or host malicious content. The primary malicious URL identified is https://ttraff.com/wix?keyword=derecho+constitucional+unam. The document body is heavily obfuscated and contains binary data, making its direct content analysis impossible.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=derecho+constitucional+unam
    • https://cdn.shopify.com/s/files/1/0437/8846/8376/files/tewire.pdf
    • https://cdn.shopify.com/s/files/1/0457/4599/5932/files/48240369042.pdf
    • https://cdn.shopify.com/s/files/1/0432/6352/5029/files/57284058569.pdf
    • https://cdn.shopify.com/s/files/1/0434/3519/6566/files/meningitis_por_candida_albicans.pdf
    • https://cdn.shopify.com/s/files/1/0435/6459/7397/files/alcoholism_test.pdf
    • https://cdn.shopify.com/s/files/1/0435/2278/5444/files/weridu.pdf
    • https://cdn.shopify.com/s/files/1/0432/9242/6405/files/24270263375.pdf
    • https://cdn.shopify.com/s/files/1/0433/3184/6296/files/wagepipu.pdf
    • https://cdn.shopify.com/s/files/1/0438/6209/8085/files/butomejimexipuda.pdf
    • https://cdn.shopify.com/s/files/1/0434/6481/8838/files/algebra_ii_textbook.pdf
    • https://cdn.shopify.com/s/files/1/0428/5949/5590/files/54572628284.pdf
    • https://cdn.shopify.com/s/files/1/0435/8370/1151/files/round_function_python.pdf
    • https://cdn.shopify.com/s/files/1/0438/9801/1816/files/zufuwixowavoloxoromik.pdf
    • https://cdn.shopify.com/s/files/1/0428/2348/3548/files/57559470153.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/zogubarekerebadopotuleju.pdf
    • https://static.usrfiles.com/ugd/9757e7_2b1fe4cd75774bb7882e986bd00c802b.pdf
    • https://static.usrfiles.com/ugd/136d07_2869acae690a475dacefa2793f10b0fb.pdf
    • https://static.usrfiles.com/ugd/b8c837_9fc9a486b9604967a546ce3f8cd15726.pdf
    • https://static.usrfiles.com/ugd/ed64d2_ee456ac832fb4aceb704474d6ff895d4.pdf
    • https://static.usrfiles.com/ugd/b8c837_86b3e735cce247c796b4d063db64c3de.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004d67.bin
93b3484c1e67019250380de01b38e25b0c6445f271d9594e09a82ca02a1c2691
pdf-font-stream PDF embedded font (sfnt) at offset 0x4D67 5036 bytes
font_01_sfnt_off00005e59.bin
0de564d7ab770b4b27cb13285d316f9a56b87eb60f76bb697748a5569bf8c50b
pdf-font-stream PDF embedded font (sfnt) at offset 0x5E59 10868 bytes