Malicious PDF — malware analysis report

Static analysis result for SHA-256 955d8af4cc3255ea…

MALICIOUS

PDF

544.0 KB Created: 2020-08-07 03:45:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7d886a3a6dfe1e48aa0ab764e9e0de49 SHA-1: 73c18a7537ebb80baa65818ed8399cc95ab98513 SHA-256: 955d8af4cc3255ea150c2e81e6f7fe891f4f634006ff350dc82d77e554c98ee2
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a critical heuristic firing indicating it links to a known malicious redirector. The embedded URL, 'https://ttraff.com/pify?keyword=ansys+tutorial+book+pdf', is the primary indicator of malicious intent, likely serving as a lure for further malicious activity. No scripts were extracted, but the PDF structure and the malicious URL strongly suggest a phishing or redirection attack.

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=ansys+tutorial+book+pdf
    • http://files.teachingandlearningwell.com/uploads/1/3/0/8/130814085/5337964.pdf
    • http://files.hawaiidisabilitylegal.com/uploads/1/3/2/7/132740361/ruziperowi.pdf
    • http://files.enzopizarrodesigns.com/uploads/1/3/1/3/131379439/xolugusimuv.pdf
    • http://busafid.anxietyannarbor.com/uploads/1/3/1/8/131857631/wuzexexewit-paluxisikazar-tesugumini.pdf
    • http://files.nikkiallred.com/uploads/1/3/1/3/131380717/d18dd8.pdf
    • https://cdn.shopify.com/s/files/1/0435/0833/4744/files/xedusegexadekevudeniru.pdf
    • https://cdn.shopify.com/s/files/1/0428/6083/9078/files/blessed_assurance_piano_solo_sheet_music.pdf
    • https://cdn.shopify.com/s/files/1/0440/1653/3654/files/71566850982.pdf
    • https://cdn.shopify.com/s/files/1/0433/4675/5734/files/nagomapusubibavezov.pdf
    • https://cdn.shopify.com/s/files/1/0432/8030/2240/files/fuvakegoraxufalej.pdf
    • https://cdn.shopify.com/s/files/1/0433/6667/8686/files/37647966385.pdf
    • https://cdn.shopify.com/s/files/1/0438/5341/4565/files/big_bang_theory_notes.pdf
    • https://cdn.shopify.com/s/files/1/0429/9105/9097/files/84824289412.pdf
    • https://cdn.shopify.com/s/files/1/0432/7401/0782/files/zafemedukat.pdf
    • https://cdn.shopify.com/s/files/1/0432/9940/5979/files/27466557676.pdf
    • https://cdn.shopify.com/s/files/1/0432/3799/8754/files/begrijpend_lezen_groep_8_oefenen_cito.pdf
    • https://cdn.shopify.com/s/files/1/0437/1959/0040/files/xawoboxa.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/48466687054.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0007e5af.bin
9b16e82678248cce17d57f01123cc30b6f962232e747c3ef1d6d8feaabfb3c62		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7E5AF 5096 bytes
font_01_sfnt_off0007f6ca.bin
7f000d4b93875be588cecacad7007f916902987487656f643d814c7f6ca08ecd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7F6CA 1188 bytes
font_02_sfnt_off0007fd9e.bin
b86ba7c510127fdc639e0d7c24ecdb68119f53cdc88e5a8ed4c45d3f42d0cb37		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7FD9E 2848 bytes
font_03_sfnt_off000808fa.bin
c63681f585e95b2fbde9f8e9acf22b48bd7769f6bfd2a9a7bed687329df4aab9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x808FA 19184 bytes
font_04_sfnt_off0008452a.bin
41f545708ea2598eea624c1a3955b9124504bae3a5ec5997fc0fd49da93ce4b4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8452A 17736 bytes
font_05_sfnt_off00086041.bin
ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x86041 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.