Malicious PDF — malware analysis report

Static analysis result for SHA-256 7e359e5f4227be40…

MALICIOUS

PDF

47.3 KB Created: 2020-09-04 15:45:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 81e979951da91593c5844d4c907c6eab SHA-1: 67ab5461efe42f45fef1eb03df722678421c433c SHA-256: 7e359e5f4227be40d5755e8d1f78f07bfcee22ada7a26cc2c9202896cb1b253b
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains heuristics indicating it is a malicious redirector and a link farm. The embedded URL, https://ttraff.club/pify?keyword=spring+webflux+vs+mvc+performance, is identified as a malicious redirector. The document body, though heavily obfuscated, also contains this URL, suggesting it is the primary lure. The file's purpose appears to be directing users to malicious infrastructure.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/pify?keyword=spring+webflux+vs+mvc+performance
    • https://cdn.shopify.com/s/files/1/0431/7193/8453/files/90601260677.pdf
    • https://cdn.shopify.com/s/files/1/0429/3387/8940/files/wexuduguliboza.pdf
    • https://cdn.shopify.com/s/files/1/0430/4447/0933/files/44174366020.pdf
    • https://cdn.shopify.com/s/files/1/0436/2059/7923/files/hydro_test_report_template.pdf
    • https://static.usrfiles.com/ugd/9c0842_db8e5f3894734b388008f9525d2c82bc.pdf
    • https://static.usrfiles.com/ugd/253000_666a73a884c442479bf052f27d71b5fb.pdf
    • https://static.usrfiles.com/ugd/93c935_ff785679f447414e87c76c07fcf8e485.pdf
    • https://static.usrfiles.com/ugd/418e76_a0be7dcc3168451c9d182db4ef6a96c7.pdf
    • https://static.usrfiles.com/ugd/37987b_e711f12ad2a64e1183be68e5008fa0fc.pdf
    • https://static.usrfiles.com/ugd/9e41f0_8f308da1d3d2482383ed24ab6a5e65a7.pdf
    • https://static.usrfiles.com/ugd/197ed4_894633612b384d488ee3bd97ac82c51a.pdf
    • https://static.usrfiles.com/ugd/b8c837_4f0ef534d9c14e938ebf0f527d2bec38.pdf
    • https://static.usrfiles.com/ugd/b11f6d_76684124286a49e782dfca465191933b.pdf
    • https://static.usrfiles.com/ugd/dcc11b_347f58b8b1d14987b6285ff9f44d45b4.pdf
    • https://static.usrfiles.com/ugd/b8c837_64e5bb49698a4c9bad2780874bc10da0.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://static.usrfiles.com/ugd/dcc11b_347f58b8b1d

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000071f0.bin
ad9f102ddb416de063f4e845f8c2c06b9a4cc7a849b46c10a23555f716b9f87d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x71F0 5796 bytes
font_01_sfnt_off000085b0.bin
fc0f91bc03265a82c016af2cf8736fe5bee0d1332ee765f39844424a1c7915d5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x85B0 13220 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.