Malicious PDF — malware analysis report

Static analysis result for SHA-256 8a34fd1dbe529428…

MALICIOUS

PDF

44.5 KB Created: 2020-08-30 04:16:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 48a8ca36d5c7c45a7c2cef5454465fc7 SHA-1: eb628e443a1eb5f168a2ecf200b039a8f2e9eb66 SHA-256: 8a34fd1dbe529428e31af34902499a975ef0b5f1cb6bb3c52d4da35f511d18e6
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.cc/wix?keyword=technology+in+action+14th+edition+isbn'. The document body, though heavily obfuscated, contains text fragments related to the document title and the malicious URL. The presence of numerous embedded links, many pointing to benign content but one to a known malicious redirector, suggests a social engineering attempt to direct the user to malicious infrastructure.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=technology+in+action+14th+edition+isbn
    • https://static.usrfiles.com/ugd/63d3ad_a86450420bb74f3eb5159977c1ac13d6.pdf
    • https://static.usrfiles.com/ugd/d9d1f5_ef6c618b531f408ea611e03f80882a7b.pdf
    • https://static.usrfiles.com/ugd/80c1db_1d92b693151a42589135a8ff6df7cd51.pdf
    • https://static.usrfiles.com/ugd/b8c837_2b2131fa1e1f4ababc1088b2e26a595f.pdf
    • https://static.usrfiles.com/ugd/b8c837_91ec4eb889314b1bb0a7a13293bba7bf.pdf
    • https://cdn.shopify.com/s/files/1/0435/2737/2955/files/befowerodexot.pdf
    • https://cdn.shopify.com/s/files/1/0435/9290/8962/files/ncert_class_12_chemistry_coordination_compounds.pdf
    • https://cdn.shopify.com/s/files/1/0428/9655/6191/files/zopelesaninawut.pdf
    • https://cdn.shopify.com/s/files/1/0432/3141/2379/files/devakilafifelojepaw.pdf
    • https://cdn.shopify.com/s/files/1/0440/1351/9006/files/36030440296.pdf
    • https://cdn.shopify.com/s/files/1/0434/8303/7860/files/binomial_theorem_worksheet_with_calculator.pdf
    • https://cdn.shopify.com/s/files/1/0430/4489/6917/files/2001_honda_crv_repair_manual.pdf
    • https://cdn.shopify.com/s/files/1/0438/8909/8907/files/87649181181.pdf
    • https://cdn.shopify.com/s/files/1/0429/9125/5713/files/crenation_definition_biology.pdf
    • https://cdn.shopify.com/s/files/1/0434/0930/9848/files/84801319511.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006366.bin
0263c53ccefbf87357622891ac9459bb9d66264f35d1da5a927e3b573934285f
pdf-font-stream PDF embedded font (sfnt) at offset 0x6366 5224 bytes
font_01_sfnt_off00007526.bin
7e8e9043203729928ec600f6d81f56432b3f3064c20efc9efca2ae5d48371222
pdf-font-stream PDF embedded font (sfnt) at offset 0x7526 9948 bytes
font_02_sfnt_off00009736.bin
0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333
pdf-font-stream PDF embedded font (sfnt) at offset 0x9736 4324 bytes