Malicious PDF — malware analysis report

Static analysis result for SHA-256 8df134fc08e41672…

MALICIOUS

PDF

59.2 KB Created: 2020-08-29 23:21:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 573cb6e2840e9cc9f6d884b390d1c5e9 SHA-1: 8b730de606bc0c3d951872af2f77467a7491a4b6 SHA-256: 8df134fc08e41672d3b39d253b518dede19ea1f6955485f69cf7a7e2c15bd5c9
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains numerous external links, a common tactic for SEO poisoning and redirecting users to malicious sites. The primary malicious URL identified is ttraff.com, which is flagged as a redirector. The document body, though heavily obfuscated, contains the same URL, reinforcing its role as a lure.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=imagenes+de+rigoberta+menchu
    • https://cdn.shopify.com/s/files/1/0431/9795/6258/files/93925551267.pdf
    • https://cdn.shopify.com/s/files/1/0438/3745/6534/files/99221008836.pdf
    • https://cdn.shopify.com/s/files/1/0429/9482/7415/files/gst_tax_slab_list.pdf
    • https://cdn.shopify.com/s/files/1/0427/5381/8790/files/86438246944.pdf
    • https://static.usrfiles.com/ugd/b8c837_db1ecebf702e4b2185c553b7d7f6d18e.pdf
    • https://static.usrfiles.com/ugd/b8c837_7f5ba125a79c4493881924967ba8e647.pdf
    • https://static.usrfiles.com/ugd/dd4472_1ca4102e232648b5816e3ae7e641d634.pdf
    • https://cdn.shopify.com/s/files/1/0428/0070/9791/files/tutabebutaperif.pdf
    • https://cdn.shopify.com/s/files/1/0429/9807/1450/files/organic_chemistry_7th_edition_solutions_manual.pdf
    • https://cdn.shopify.com/s/files/1/0465/5372/7126/files/62785088159.pdf
    • https://cdn.shopify.com/s/files/1/0429/3633/6540/files/91875444784.pdf
    • https://static.usrfiles.com/ugd/b8c837_5a9305f6588b4474adc7c5e9845fe4ff.pdf
    • https://static.usrfiles.com/ugd/b8c837_e98a78be759f4755a6cfcf6a87a56ff2.pdf
    • https://static.usrfiles.com/ugd/b8c837_04cff1fba101469d8086848e1e7b3807.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000a528.bin
0a749d4db3d6b053c28ade3d22ec721527a4bf2dae5d58e6c2670985c6d6304c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA528 5396 bytes
font_01_sfnt_off0000b743.bin
7a4d0f4d46073bc7d2fea33a78d72d28b30060c3c35d155adf70aead942f50c3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB743 12036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.