Malicious PDF — malware analysis report

Static analysis result for SHA-256 971122de647b1edb…

MALICIOUS

PDF

51.7 KB Created: 2020-08-30 22:20:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9c50816292ce4e425b7234ff9596c144 SHA-1: ab388b2aa874e65d9a9039e4cddc33482256ae1a SHA-256: 971122de647b1edbb61399e96b2cc0365030ea8d924b7dfb208102eccf5b6c96
140 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a lure related to a 'swtor cartel market error code 9' and embeds a link to a known malicious redirector. The document also contains a mass external PDF link farm, suggesting an attempt to manipulate search engine results or distribute further malicious content. The presence of a callback phishing lure indicates a social engineering attempt to engage the user directly.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=swtor+cartel+market+error+code+9
    • https://static.usrfiles.com/ugd/89c6ad_8a73266b25c04c4183ab05694fa20242.pdf
    • https://static.usrfiles.com/ugd/9d869b_f883324f8b2e47649e756b4495c0a99b.pdf
    • https://static.usrfiles.com/ugd/88a84f_012ed6918c1040e79516d47a4954c412.pdf
    • https://static.usrfiles.com/ugd/b5472a_591612170d7a4b4fac32711ecc57513c.pdf
    • https://static.usrfiles.com/ugd/b8c837_ceb9385c38a94f67ae156edaa31c7a55.pdf
    • https://cdn.shopify.com/s/files/1/0462/5793/0394/files/magidiganuxazewetedadalot.pdf
    • https://cdn.shopify.com/s/files/1/0430/3765/5191/files/pdf_algorithme_tableau.pdf
    • https://cdn.shopify.com/s/files/1/0434/0210/0886/files/85574765042.pdf
    • https://cdn.shopify.com/s/files/1/0434/5148/2278/files/67440839864.pdf
    • https://cdn.shopify.com/s/files/1/0432/0778/6651/files/bonatedexozotuwawigotizav.pdf
    • https://cdn.shopify.com/s/files/1/0437/6946/2935/files/the_filmmakers_handbook_epub.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007e08.bin
15954a76f4b9564960d879adfcebfd42c2ebf7ba6785428d463c0e7a98ef1ae6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7E08 4956 bytes
font_01_sfnt_off00008ef1.bin
23ab9e859c4897ccd155c6182f2754a8e7291bb2c5d2232ac2e3227ac7b214e4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8EF1 10932 bytes
font_02_sfnt_off0000b3f9.bin
05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB3F9 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.