Malicious PDF — malware analysis report

Static analysis result for SHA-256 5777aa4822d09ca8…

MALICIOUS

PDF

41.3 KB Created: 2020-09-08 14:09:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: be63b8959c533903dd957e5805213332 SHA-1: 526ea9d09c2ab75e911eb1880a40e2649223f292 SHA-256: 5777aa4822d09ca8a630836984a82098ee417a4d5e504a908d2d36a1edffcda5
140 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 User Execution: Malicious Link

The PDF file contains a link to a known malicious redirector, ttraff.me, which is disguised as a guide for VPNs. The document body also contains numerous links to external PDFs, many hosted on Shopify, suggesting a link farm or SEO poisoning tactic. The presence of a QR code lure further indicates a phishing or social engineering attempt.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • QR-code redirect lure medium SE_QR_LURE
    Document instructs the user to scan a QR code with a phone — consistent with QR phishing, but also common in legitimate documents
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/pify?keyword=best+adblock+vpn+for+android
    • https://cdn.shopify.com/s/files/1/0436/1561/7182/files/copaiba_softgels_doterra.pdf
    • https://cdn.shopify.com/s/files/1/0439/2937/0779/files/45270592182.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/44603331863.pdf
    • https://cdn.shopify.com/s/files/1/0431/0574/7095/files/papugagaxibukeret.pdf
    • https://cdn.shopify.com/s/files/1/0440/6122/9206/files/roseduvadudepovifoxigiged.pdf
    • https://static.usrfiles.com/ugd/2b3f46_8ca1e6c925b24b56ac758b201b96e6c3.pdf
    • https://static.usrfiles.com/ugd/f967ac_b4720a65a5c74b008c5c10cc17ea78aa.pdf
    • https://static.usrfiles.com/ugd/b8c837_58fdfc4a8f1b44278fbdad7c90667232.pdf
    • https://static.usrfiles.com/ugd/d017d5_d36e4d0a3ad849c6bbcc992634c929ad.pdf
    • https://static.usrfiles.com/ugd/9eb187_1ac50d85097f40d387d309d77124e939.pdf
    • https://static.usrfiles.com/ugd/b8c837_344215e993c5403eb9505e7d16cfb44e.pdf
    • https://static.usrfiles.com/ugd/d94ae5_4cea30ce865547f5852ec4e51d5dabe5.pdf
    • https://cdn.shopify.com/s/files/1/0438/2228/4960/files/value_of_old_playboy_magazines.pdf
    • https://cdn.shopify.com/s/files/1/0465/5418/5878/files/44643938571.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006326.bin
187ea8dfbeff21c2b7e8f03376541ad9d1f75737bc3d3500b471fcd9311e3ce9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6326 5460 bytes
font_01_sfnt_off000075d0.bin
dc6470d117b591bc0c071e3b9b69665e2067208aa300d63c82ed64a7ec512507		 pdf-font-stream PDF embedded font (sfnt) at offset 0x75D0 10280 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.