Malicious PDF — malware analysis report

Static analysis result for SHA-256 911a862f30486e60…

MALICIOUS

PDF

36.4 KB Created: 2020-08-09 09:21:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f9aefa3d9872933128845a1042c7ba4a SHA-1: b9d776651371e4cbea5c71574147828f3870fdb1 SHA-256: 911a862f30486e6045594f95e821743c729cf2f72bbe89c2c3f1158c97f6fb16
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a link to a known malicious redirector, ttraff.cc, which is designed to lure users into clicking through to potentially harmful content. The document body, though heavily obfuscated, contains text related to 'simple past tense exercises' and includes the malicious URL, suggesting a social engineering pretext. The presence of a 'download button' heuristic further supports the attack pattern of tricking the user into clicking the malicious link.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=simple+past+tense+exercises+pdf+with+answers
    • http://files.hmbudgetravel.com/uploads/1/3/1/3/131380343/8620543.pdf
    • http://files.konnektable.net/uploads/1/3/1/4/131438056/9649213.pdf
    • http://files.somosfamiliavalle.org/uploads/1/3/1/1/131164152/nepirixoxilid_nojekowimomiki.pdf
    • http://files.rockthecatspa.us/uploads/1/3/1/4/131437619/vuwudexuj.pdf
    • https://cdn.shopify.com/s/files/1/0428/4055/5676/files/7704426496.pdf
    • https://cdn.shopify.com/s/files/1/0438/2470/9794/files/abecedario_mayusculas_y_minusculas_para_imprimir.pdf
    • https://cdn.shopify.com/s/files/1/0432/3121/5780/files/fowij.pdf
    • https://cdn.shopify.com/s/files/1/0431/9048/5150/files/woviwazufurug.pdf
    • https://cdn.shopify.com/s/files/1/0431/3173/2119/files/48664668634.pdf
    • https://cdn.shopify.com/s/files/1/0430/8752/8103/files/ruwuju.pdf
    • https://cdn.shopify.com/s/files/1/0434/9735/7472/files/ps3_controller_driver_for_mac.pdf
    • https://cdn.shopify.com/s/files/1/0434/6275/4461/files/paragon_partition_manager.pdf
    • https://cdn.shopify.com/s/files/1/0431/8724/1119/files/revabem.pdf
    • https://cdn.shopify.com/s/files/1/0428/2135/3635/files/certainteed_flintlastic.pdf
    • https://cdn.shopify.com/s/files/1/0429/3338/7423/files/crop_image_in_inkscape.pdf
    • https://cdn.shopify.com/s/files/1/0437/5016/2581/files/7401351099.pdf
    • https://cdn.shopify.com/s/files/1/0429/6730/2295/files/pdfbox_java_api_documentation.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004f07.bin
123e9df5ec0404484b90340b10992c8849e581a8c5ca4ac0034b57da84d176a3
pdf-font-stream PDF embedded font (sfnt) at offset 0x4F07 5660 bytes
font_01_sfnt_off00006231.bin
e8fb1acb58b3c85908df557180e5bd00efb4dd3692ffc2203c16c3e925d0da9c
pdf-font-stream PDF embedded font (sfnt) at offset 0x6231 10020 bytes