Malicious PDF — malware analysis report

Static analysis result for SHA-256 7fe30607d2dff1f2…

MALICIOUS

PDF

48.8 KB Created: 2020-09-16 15:47:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5cda19d73210fa49f3a9f68c82c8e398 SHA-1: b6793c10aaf02ea27c7c27c7f65e7de8095b3229 SHA-256: 7fe30607d2dff1f28ca653e48dbc130c4a41a5436b56074099aedadc7908dae3
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a heuristic firing for a malicious redirector link, specifically pointing to 'https://ttraff.club/wix?keyword=senior+project+presentations'. This indicates a social engineering attempt to lure the user to a malicious site. The document also contains a large number of embedded links, many of which point to benign Shopify URLs, suggesting a link farm or SEO poisoning tactic to mask the malicious redirector. No scripts were extracted from this sample.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/wix?keyword=senior+project+presentations
    • http://files.hempourfuture.com/uploads/1/3/0/7/130775286/pulidi.pdf
    • http://mugun.paslibrary.com/uploads/1/3/2/6/132683001/4359540.pdf
    • http://wikawiz.ode2oddz.com/uploads/1/3/1/4/131452838/56b6604.pdf
    • http://vuretifin.techbyjeni.com/uploads/1/3/1/4/131437490/wizofixire.pdf
    • https://dac8539d-ef92-4410-
    • https://cdn.shopify.com/s/files/1/0465/4956/5590/files/free_competency_framework_template.pdf
    • https://cdn.shopify.com/s/files/1/0434/4243/8310/files/the_modern_world_history_textbook.pdf
    • https://cdn.shopify.com/s/files/1/0431/6705/6028/files/lagu_album_bts_lengkap.pdf
    • https://cdn.shopify.com/s/files/1/0432/8115/4204/files/doxarodepetikora.pdf
    • https://cdn.shopify.com/s/files/1/0458/1071/2742/files/christmas_song_medley_remix_free.pdf
    • https://3269139c-75f9-4785-96c6-75e9e9564169.filesusr.com/ugd/d4a9d6_2dce65f5eb194683bc3eb4f15ce33864.pdf?index=true
    • https://a03acae4-8ff9-4a8c-9b02-591fa23d5680.filesusr.com/ugd/6846fe_c33340306eb0405e819360ccafdf75f9.pdf?index=true
    • https://01dbf5a0-6041-49b2-b7b1-6dc0f12b3335.filesusr.com/ugd/dcf9ad_5bb9d7224d174eca9e7b7c3aa65d0898.pdf?index=true
    • https://4232bd0b-086b-4f76-a133-86c47e81902b.filesusr.com/ugd/bc4951_3ff626257b904ca2b4230bb58560e44b.pdf?index=true
    • https://9444016e-06ce-419e-aa60-d42868082fd3.filesusr.com/ugd/277b62_c978c0e40bbd4d14be5bbf9b6cb23179.pdf?index=true
    • https://d7cf27d4-e704-4770-9ee2-824cf80cbd29.filesusr.com/ugd/417718_a51c03ee7d4c4d99a8b10ffb65bfb88f.pdf?index=true
    • https://93c646b5-6f6a-4a73-b63f-873c6a43376e.filesusr.com/ugd/c57cae_7f6a72303cc84a20931329073eee1d52.pdf?index=true
    • https://79af0977-8ad5-4680-9ddd-c3e9887f165b.filesusr.com/ugd/3a38e0_50a9b945ce4e4e339d8dfdaa9736acb7.pdf?index=true
    • https://dac8539d-ef92-4410-b8bd-ab27b71a7d9f.filesusr.com/ugd/5f226b_aee00d9639154a10b7228f9996b31347.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006ae5.bin
17bcdc797274c9a1643b741b364834ede6af8da09a3cc665f7d006fd5e70ea84		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6AE5 4864 bytes
font_01_sfnt_off00007b60.bin
9cd37e53b110e057741b855e2b3733dea17b2a5b141a0ec9c6f74aee463f181b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7B60 14272 bytes
font_02_sfnt_off0000a801.bin
0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA801 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.