Malicious PDF — malware analysis report

Static analysis result for SHA-256 971cc524fd2d99e5…

MALICIOUS

PDF

43.0 KB Created: 2020-08-09 18:53:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 82674c5bab4d69bfeef7d90020b64562 SHA-1: cba5f61790be4d421dcaf07cca2db9a5431303a2 SHA-256: 971cc524fd2d99e5d30f81da93f6b44862e8548d91dc584c20c98519a38d9c73
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a mass external link farm, with the primary redirector URL being https://ttraff.com/pify?keyword=breast+cancer+treatment+options+pdf. This indicates a likely attempt to lure users to malicious content. The document body, though heavily obfuscated, contains references to the redirector URL and other benign-looking PDF links, suggesting a deceptive content strategy. No scripts were extracted, limiting the analysis of direct payload execution.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=breast+cancer+treatment+options+pdf
    • http://jagelem.pgtaosa.org/uploads/1/3/2/3/132302978/xigekowu.pdf
    • http://files.shopbrowsandbeauty.com/uploads/1/3/1/4/131408103/vereb.pdf
    • http://files.nickpateras.org/uploads/1/3/2/7/132710655/d914f150ae.pdf
    • http://betazo.coutellerie-le-cellois.com/uploads/1/3/1/0/131070161/9490754.pdf
    • http://tusaf.dejligedayswelcome.com/uploads/1/3/2/6/132681670/3a45140f9afc.pdf
    • https://cdn.shopify.com/s/files/1/0440/3032/8997/files/nabefevevo.pdf
    • https://cdn.shopify.com/s/files/1/0428/4963/2415/files/tusudemuzi.pdf
    • https://cdn.shopify.com/s/files/1/0436/2492/3298/files/kaantasan_ng_pang_uri_worksheets_grade_4.pdf
    • https://cdn.shopify.com/s/files/1/0431/1502/0448/files/diromarixajotepapip.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/81599599528.pdf
    • https://cdn.shopify.com/s/files/1/0432/8715/0752/files/gerorejemumala.pdf
    • https://cdn.shopify.com/s/files/1/0430/7956/5465/files/eyebrow_raised_emoticon.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/suramagufumaxuragozud.pdf
    • https://cdn.shopify.com/s/files/1/0427/5827/5238/files/sabowifuxuwalus.pdf
    • https://cdn.shopify.com/s/files/1/0436/4229/0336/files/86045872464.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006ab9.bin
4951b950738037e07dcf280daaf07d5b50dacfa02d8ac17ecc92d88e8a97619c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6AB9 5320 bytes
font_01_sfnt_off00007cb8.bin
0926ffc81680a688fe627801c5ece68e24abf0adb12efb0b2da971830c0eb362		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7CB8 9984 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.