Malicious PDF — malware analysis report

Static analysis result for SHA-256 93093932d875bb10…

MALICIOUS

PDF

57.5 KB Created: 2020-08-07 00:31:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fdffae6213ab42b0a607d1488177b376 SHA-1: 3847d33d7f97d4dd66f3da48e7706a09e4d46bfb SHA-256: 93093932d875bb1021957410c3e128c7e49d0146d25f19c9e08e191d42d308bf
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a deceptive title and numerous embedded links, many of which point to a link farm hosted on Shopify. One critical heuristic identified a link to a known malicious redirector, ttraff.cc, which is used to obscure the final destination. This redirector is likely part of a phishing or malware distribution scheme, aiming to trick users into downloading further malicious content or visiting compromised sites.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=botany+practical+book+for+bsc+2nd+year+pdf
    • http://dubuzew.hydrelief.com/uploads/1/3/1/3/131380429/9887652.pdf
    • http://files.matthewhawkeldridge.com/uploads/1/3/2/6/132683070/2728644.pdf
    • http://files.stefankehlenbach.com/uploads/1/3/1/4/131437322/b9139cae.pdf
    • https://cdn.shopify.com/s/files/1/0430/8752/8103/files/59551258296.pdf
    • https://cdn.shopify.com/s/files/1/0430/9018/2304/files/bemarifabesavezomizal.pdf
    • https://cdn.shopify.com/s/files/1/0434/4584/6168/files/20623134613.pdf
    • https://cdn.shopify.com/s/files/1/0433/9659/5868/files/assessment_in_special_and_inclusive_education_12th_edition.pdf
    • https://cdn.shopify.com/s/files/1/0430/9444/2145/files/pokanux.pdf
    • https://cdn.shopify.com/s/files/1/0436/1011/2163/files/afcat_exam_paper.pdf
    • https://cdn.shopify.com/s/files/1/0437/4714/7925/files/wudelefapus.pdf
    • https://cdn.shopify.com/s/files/1/0433/1231/6584/files/59604758880.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/395667921.pdf
    • https://cdn.shopify.com/s/files/1/0429/1392/3228/files/95600769832.pdf
    • https://cdn.shopify.com/s/files/1/0438/2310/4160/files/90044072847.pdf
    • https://cdn.shopify.com/s/files/1/0432/4635/4594/files/19254018974.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007530.bin
db8792d518016b81fff38e7f68e3a1d61cb04b2410baf120e7ea8e9d4d229d02		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7530 5636 bytes
font_01_sfnt_off00008876.bin
35c0a746fcdf55e64f2ba55209f6a139fa5d4ea47dce36c63c78d1e6d66b29b6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8876 3204 bytes
font_02_sfnt_off00009567.bin
d97e055e11de589539a249dfdf9c15aca1e9caf4700104d1763a3a5d87d8f7f2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9567 2320 bytes
font_03_sfnt_off00009fb9.bin
e1d458ff53bfa926267c73d43db88dfe99cd83b6aec62d97b7d3ff112a1e9a6c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9FB9 10100 bytes
font_04_sfnt_off0000c23b.bin
207faf14306426b668b87aba0c9d447b8ba40b67f0f7b18660ffa0d3c8132265		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC23B 16224 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.