Malicious PDF — malware analysis report

Static analysis result for SHA-256 7c982e8ca2d901a1…

MALICIOUS

PDF

51.5 KB Created: 2020-08-04 19:12:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 81ce88e93f78b842bd46584ad4a8df17 SHA-1: 285e139d70ec4928f8761bcf2ac1a91a75d5351f SHA-256: 7c982e8ca2d901a1db970a51a9a5da94df2c3fa4b060d8b9ed38211356c7d533
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Phishing: Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains numerous links, many of which point to a link farm hosted on Shopify. One of the primary links redirects through ttraff.com, a known malicious redirector, to a lure document disguised as 'Business studies grade 11 exam papers and memos 2020 pdf'. The presence of a visual download button further supports a social engineering lure. No scripts were extracted from this sample.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=business+studies+grade+11+exam+papers+and+memos+2020+pdf
    • http://files.athousandpetals.org/uploads/1/3/2/6/132695620/duxupaxeduj.pdf
    • http://files.jordanthariel.com/uploads/1/3/1/3/131383283/fcd9cd793655.pdf
    • http://files.tatestech.com/uploads/1/3/0/7/130776573/niminiwugekubuwe.pdf
    • http://files.westerngate-fta.org/uploads/1/3/1/3/131381259/kokudegonodi.pdf
    • http://files.suzannejefferies.com/uploads/1/3/1/3/131383541/0ec32b397bada.pdf
    • https://cdn.shopify.com/s/files/1/0429/2870/1603/files/wugegetefakewagenubikuse.pdf
    • https://cdn.shopify.com/s/files/1/0435/2458/7674/files/37585627986.pdf
    • https://cdn.shopify.com/s/files/1/0435/1626/4616/files/19624924412.pdf
    • https://cdn.shopify.com/s/files/1/0427/5165/6102/files/20052900061.pdf
    • https://cdn.shopify.com/s/files/1/0437/8837/0072/files/gedoxotimoxubulim.pdf
    • https://cdn.shopify.com/s/files/1/0429/4000/6559/files/33176022725.pdf
    • https://cdn.shopify.com/s/files/1/0429/2476/9436/files/5845194618.pdf
    • https://cdn.shopify.com/s/files/1/0430/1747/0101/files/sigaza.pdf
    • https://cdn.shopify.com/s/files/1/0432/9416/3109/files/35378480345.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/16946396068.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000608b.bin
24fd6868f187b5667792517f9f69d22ac5a3de5011d4d3824467392effeade79		 pdf-font-stream PDF embedded font (sfnt) at offset 0x608B 6588 bytes
font_01_sfnt_off00007105.bin
b6b9c1a8672b147b8ef51046ed2b6815490315057c51e2d1127704f3e686a6a6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7105 5652 bytes
font_02_sfnt_off00008424.bin
fcfb8f0e55ad9df5a1ad0726378e3a06894f11344b8aecece3a66ee94f149217		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8424 2252 bytes
font_03_sfnt_off00008d8a.bin
61e4106e374250ce26da32d17cc65cbceceebe5fae776f1882250a4297ad6dd0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8D8A 10620 bytes
font_04_sfnt_off0000b1a7.bin
0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB1A7 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.