Malicious PDF — malware analysis report

Static analysis result for SHA-256 904c90fa03aeec00…

MALICIOUS

PDF

30.8 KB Created: 2020-08-22 09:28:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4428c459ba16b62cc1474e997fe16c1f SHA-1: fe7a699f405e2d7a54e122de9f824143813dd5a0 SHA-256: 904c90fa03aeec0094647165469f864a43d84b7f235a9be7da9c2c692c86c43f
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, many of which point to Shopify domains hosting other PDFs, suggesting a link farm for SEO manipulation or traffic redirection. Crucially, one of the embedded URLs, 'https://ttraff.cc/pify?keyword=pet+animals+hd+images', is flagged as a known malicious redirector. This indicates the document's primary purpose is to direct users to malicious infrastructure, likely for further exploitation or phishing.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=pet+animals+hd+images
    • http://files.hillsdalecountychamber.com/uploads/1/3/0/7/130775537/pefusi.pdf
    • http://files.disctilldawn.co.uk/uploads/1/3/0/7/130775222/3e1f1707f401.pdf
    • https://cdn.shopify.com/s/files/1/0429/4233/3087/files/34877206881.pdf
    • https://cdn.shopify.com/s/files/1/0429/2250/8454/files/63478541607.pdf
    • https://cdn.shopify.com/s/files/1/0434/2952/7709/files/super_mario_bros_background.pdf
    • https://cdn.shopify.com/s/files/1/0440/1309/3029/files/andhra_pradesh_history_and_culture.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/redukenedobitaguwowok.pdf
    • https://cdn.shopify.com/s/files/1/0431/6915/3181/files/82535321697.pdf
    • https://cdn.shopify.com/s/files/1/0429/5072/1699/files/subject_pronouns_practice_worksheets.pdf
    • https://cdn.shopify.com/s/files/1/0431/0574/7095/files/81803733920.pdf
    • https://cdn.shopify.com/s/files/1/0435/2986/3320/files/simple_past_tense_verbs.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003f41.bin
1ae1935d8851132bc10047fd8693f7bcf87ae058d925aaebb6985ba195126f6e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3F41 5144 bytes
font_01_sfnt_off0000508e.bin
fbb650f950fd679bd20720cbad5b95e93056894628e61aaf8e060b8e6d2aa898		 pdf-font-stream PDF embedded font (sfnt) at offset 0x508E 8936 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.