Malicious PDF — malware analysis report

Static analysis result for SHA-256 85053ca4514d74b3…

MALICIOUS

PDF

46.2 KB Created: 2020-08-08 11:39:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7bd817f1793ebd8b5bab15bd2f9da72c SHA-1: 87af58ad7ab7285865c9a677b1a49526932d2bd8 SHA-256: 85053ca4514d74b3a19ebc612ff89857aad2bc885067feb51adbc35e0d30e2f4
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.com/wb?keyword=pte%20general%20level%204%20practice%20test%20pdf'. This indicates the document's primary purpose is to redirect users to malicious infrastructure. The document body, though heavily obfuscated, contains references to the same URL and other URLs hosted on Shopify and other domains, suggesting a link farm or content distribution network is being leveraged. No scripts were extracted from this sample.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wb?keyword=pte%20general%20level%204%20practice%20test%20pdf
    • http://files.rmpaintingintext.com/uploads/1/3/1/3/131379590/duxisuj.pdf
    • http://ruxogitem.icatracho.com/uploads/1/3/1/3/131398140/rifuwikozajiwi.pdf
    • http://files.southernwildproducts.com/uploads/1/3/1/3/131398475/e551b643fb05.pdf
    • https://cdn.shopify.com/s/files/1/0428/0628/0355/files/79540223958.pdf
    • https://cdn.shopify.com/s/files/1/0431/9775/9643/files/23045717408.pdf
    • https://cdn.shopify.com/s/files/1/0438/6009/9222/files/46140442513.pdf
    • https://cdn.shopify.com/s/files/1/0430/7792/7072/files/laugh_it_up_fuzzball_torrent.pdf
    • https://cdn.shopify.com/s/files/1/0429/8866/7034/files/wasofu.pdf
    • https://cdn.shopify.com/s/files/1/0434/1887/8114/files/worataj.pdf
    • https://cdn.shopify.com/s/files/1/0437/7201/8845/files/85473718419.pdf
    • https://cdn.shopify.com/s/files/1/0431/6341/8784/files/18609220972.pdf
    • https://cdn.shopify.com/s/files/1/0433/3358/2998/files/40038667368.pdf
    • https://cdn.shopify.com/s/files/1/0435/9385/9231/files/trochanteric_bursitis_exercises_nhs.pdf
    • https://cdn.shopify.com/s/files/1/0434/3015/0309/files/nadafumediw.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005900.bin
3edcca935a1decb3711a45a11354d423658b34ba7eb2ca4880ebe65cc077af1b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5900 6452 bytes
font_01_sfnt_off00006902.bin
6a711db3ab2abb45ce8b2db99699350be46f3f5d8fc61cb62f9b808c7f613451		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6902 5472 bytes
font_02_sfnt_off00007bb8.bin
3662cb743c9efaad197d21484c20f31dd107a1d14215e1b088a87bb4062020ae		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7BB8 2984 bytes
font_03_sfnt_off0000879a.bin
79e0092cd36e1604119e070692c0fdc585f9e39cebc8f83457ec938dace88927		 pdf-font-stream PDF embedded font (sfnt) at offset 0x879A 10388 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.