Malicious PDF — malware analysis report

Static analysis result for SHA-256 56ab173a9de448d2…

MALICIOUS

PDF

74.1 KB Created: 2020-09-19 19:45:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bba29d251ce7056bac30897ff7e9d5bf SHA-1: 862b46fca5d556dee69f16775fa5e33fdf3e23b1 SHA-256: 56ab173a9de448d225ea0af611602b2a97d267bf63d3bd0422474c660cd0dbae
180 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a critical heuristic firing for a malicious redirector link, which is also present in the document body. It also contains a heuristic for a PDF link farm, with numerous links hosted on cdn.shopify.com. The document explicitly requests recovery secrets, indicating a phishing attempt. The primary malicious URL is https://ttraff.link/wix?keyword=dx2+reroll+guide, which likely leads to a further stage of the attack.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Recovery secret / private key request critical SE_SECRET_RECOVERY_LURE
    Document requests recovery phrases, private keys, backup codes, or saved passwords. Requests for these secrets in a document are high-risk.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/wix?keyword=dx2+reroll+guide
    • https://cdn.shopify.com/s/files/1/0432/1152/2209/files/fasuvulerugeranisawexe.pdf
    • https://cdn.shopify.com/s/files/1/0462/4436/4448/files/whatsapp_for_windows_phone_apk.pdf
    • https://cdn.shopify.com/s/files/1/0431/9569/5265/files/apa_the_easy_way_updated_for_apa_6th_edition.pdf
    • https://cdn.shopify.com/s/files/1/0432/9304/8992/files/66026679656.pdf
    • https://cdn.shopify.com/s/files/1/0428/0510/0707/files/gerinefejevoganose.pdf
    • https://cdn.shopify.com/s/files/1/0432/1706/0007/files/pobezubisojonove.pdf
    • https://cdn.shopify.com/s/files/1/0437/8417/5773/files/michelle_beatles_piano_chords.pdf
    • https://cdn.shopify.com/s/files/1/0428/1863/3894/files/62869516910.pdf
    • https://cdn.shopify.com/s/files/1/0433/3063/3881/files/rotate_90_degrees.pdf
    • https://cdn.shopify.com/s/files/1/0464/5093/3928/files/editable_wedding_invitation_templates_free_online.pdf
    • https://cdn.shopify.com/s/files/1/0429/8106/4853/files/doctors_first_report_workers_comp.pdf
    • https://cdn.shopify.com/s/files/1/0433/8135/8759/files/66292765569.pdf
    • https://a86ff28d-c01a-4543-900c-21f02f02fa54.filesusr.com/ugd/3d514e_b73b4dd0ef8f41e682b30b4d6cee9bcc.pdf?index=true
    • https://86cfa70f-876a-40ca-a4d1-3221efdb1a22.filesusr.com/ugd/70e5f7_1b85f6c503bf42b9ac9118a4234b2b41.pdf?index=true
    • https://5932c061-0add-40cb-8937-68826dce6400.filesusr.com/ugd/4c1554_4a086e128dee4da585283355908f7f79.pdf?index=true
    • https://ebea49b5-168a-4869-a963-450f8894385a.filesusr.com/ugd/856cea_9c8ff1045e2944c682c5cd73116145bb.pdf?index=true
    • https://72fe77a3-9748-49f3-85fc-8f92d95baff7.filesusr.com/ugd/c63bf9_cc15913099c446ccbb6b683ba0a97de2.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://72fe77a3-9748-49f3-85fc-8f92d95baff7.filesusr.com/ugd/c63bf9_cc15913099c446ccbb6b683ba0a97de2.pdf?ind

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cdac.bin
dd95bc93c17d6deeadb524417e2a109f74779e2c113b1cc9acee0ada639c8e1d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCDAC 4804 bytes
font_01_sfnt_off0000de1c.bin
93061f6b5b7cf917a82400cd882f064b055f4a541ccb7a44fd79857a727b8f39		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDE1C 12492 bytes
font_02_sfnt_off0001067a.bin
c9557d91917e40dbb2ce09b7ef560a04a9a832ffe2ebcac6b50408a58351272e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1067A 16092 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.