Malicious PDF — malware analysis report

Static analysis result for SHA-256 779e3a97f5b7a5f3…

MALICIOUS

PDF

39.5 KB Created: 2020-09-02 23:49:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4d4a6d433e728e1127bdace297b0f74e SHA-1: 5eae353fb6160fb2b0c3e98a2b64ea2fd90cb6f0 SHA-256: 779e3a97f5b7a5f37abb4aef7bdb4be2b3770d79aad45781e9cc68cd7fdd7956
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a heuristic firing for a malicious redirector link, specifically pointing to 'https://ttraff.link/wix?keyword=dividends+and+capital+gains+worksheet'. The document body, though heavily obfuscated, also contains this URL, suggesting it's the primary lure. The presence of a PDF link farm heuristic indicates a broader campaign to distribute malicious content. No scripts were extracted from this sample.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/wix?keyword=dividends+and+capital+gains+worksheet
    • https://cdn.shopify.com/s/files/1/0431/0227/3703/files/situacion_didactica_de_pintores_mexi.pdf
    • https://cdn.shopify.com/s/files/1/0429/3463/2607/files/hand_lettering_guidelines.pdf
    • https://cdn.shopify.com/s/files/1/0437/2578/3190/files/57211126204.pdf
    • https://cdn.shopify.com/s/files/1/0433/9813/5966/files/bugatexuliripovivejutuxus.pdf
    • https://cdn.shopify.com/s/files/1/0432/4206/1986/files/linkedin_boolean_search.pdf
    • https://cdn.shopify.com/s/files/1/0449/2935/1835/files/aristotle_nicomachean_ethics_irwin.pdf
    • https://cdn.shopify.com/s/files/1/0429/7952/4759/files/dixadalobepavorasigar.pdf
    • https://cdn.shopify.com/s/files/1/0431/8714/2819/files/53880825404.pdf
    • https://cdn.shopify.com/s/files/1/0439/0024/0024/files/ligopudada.pdf
    • https://static.usrfiles.com/ugd/3aee12_d40e12e1cdc54a4f8c4e9f1cea99a8ff.pdf
    • https://static.usrfiles.com/ugd/fe83c3_6a57e3a7d7ee4d96be72502791b8b131.pdf
    • https://static.usrfiles.com/ugd/a48928_16229aca700b4b3c9ac942af1eaf32cc.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://cdn.shopify.com/s/fi

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000059c3.bin
81f0df63689193cf8e23b4de0662b47a655da1eb0c776dee0271d6ed4b3bd081		 pdf-font-stream PDF embedded font (sfnt) at offset 0x59C3 5552 bytes
font_01_sfnt_off00006cbb.bin
a7a652cc8d379dbfbadb6d180880639c1e49a810acdcf207754a9103a0627c59		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6CBB 10712 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.