Malicious PDF — malware analysis report

Static analysis result for SHA-256 8f37a4c174a38cd5…

MALICIOUS

PDF

49.4 KB Created: 2020-08-15 04:26:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 47d922d1240541f3d3812df840697028 SHA-1: d7bafb37aa30c91a5004dace3a9131052fcac364 SHA-256: 8f37a4c174a38cd531a172a045b4e1c5e53e2b9fb8cde5c95512f03057e5e783
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.cc/pify?keyword=tv+azteca+news+reporter'. This URL is embedded within the document body, suggesting a lure to entice users to click. The PDF also exhibits characteristics of a link farm, with numerous embedded links to other PDFs, likely for SEO manipulation or to host further malicious content. No scripts were extracted, but the primary attack vector appears to be social engineering via a malicious link.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=tv+azteca+news+reporter
    • http://files.toadsoftowedhaul.com/uploads/1/3/2/8/132815752/2564212.pdf
    • http://files.csureddies.com/uploads/1/3/0/9/130969710/poxodomojab.pdf
    • http://files.levania.net/uploads/1/3/0/7/130740536/rufenijuziw.pdf
    • http://tifija.carlsbadwinterwine.com/uploads/1/3/0/7/130775735/e6fc09539d.pdf
    • https://cdn.shopify.com/s/files/1/0427/9386/1279/files/51237303533.pdf
    • https://cdn.shopify.com/s/files/1/0433/6749/7880/files/16461247474.pdf
    • https://cdn.shopify.com/s/files/1/0437/7994/8705/files/wizalifuguvuzoledazu.pdf
    • https://cdn.shopify.com/s/files/1/0434/9162/3077/files/resume_for_job_example.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/34597476450.pdf
    • https://cdn.shopify.com/s/files/1/0437/2175/2726/files/zaresinazakogax.pdf
    • https://cdn.shopify.com/s/files/1/0429/5386/7427/files/wolavovude.pdf
    • https://cdn.shopify.com/s/files/1/0431/8766/7104/files/29342745286.pdf
    • https://cdn.shopify.com/s/files/1/0431/1829/7245/files/amoeba_sisters_enzymes.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/35209966956.pdf
    • https://cdn.shopify.com/s/files/1/0433/4754/2165/files/wireless_bluetooth_earbuds_for_android_phone.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000062fe.bin
ccc937deb519d261dd7b36864d03c4df05364f22fddbcb1116ccc8b51c38d624		 pdf-font-stream PDF embedded font (sfnt) at offset 0x62FE 5048 bytes
font_01_sfnt_off0000744b.bin
3a98c81cb71b27fd1185076fc3b3cfcddb9b36dd35e089cf64f68d3236adbace		 pdf-font-stream PDF embedded font (sfnt) at offset 0x744B 1688 bytes
font_02_sfnt_off00007cc4.bin
e84c56c3416f9502b7449b5562ad65e5604c569a1dea9fd081e4967dd941c5c1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7CC4 11236 bytes
font_03_sfnt_off0000a2e4.bin
a180d3a50eca3ddcebf424b1183e9f30455a78618e3ed76e4389bca50b1fd8c6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA2E4 16240 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.