Malicious PDF — malware analysis report

Static analysis result for SHA-256 98488110f1b9cd4d…

MALICIOUS

PDF

45.7 KB Created: 2020-07-20 01:13:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 42a5fe5834acfd0f0e2625de7a92ea0f SHA-1: 33e3e466a432544959b8587af5238885f7f1a1bd SHA-256: 98488110f1b9cd4db3e09ba238609e28b8edcdc057b41e3699f7cd4bd4e2979e
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, many of which point to external PDF files hosted on various domains. One critical link directs to a known malicious redirector at 'ttraff.com'. This indicates the document is likely part of an SEO poisoning or link farm attack, designed to lure users to malicious sites or distribute further payloads. No scripts were extracted, and the document body was heavily obfuscated.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wb?keyword=beechcraft%20baron%2058%20flight%20manual%20pdf
    • http://files.stetsonrowles.com/uploads/1/3/0/7/130775677/xobixodizo_xirav_nomovivozoz.pdf
    • http://files.brushandbranch.co/uploads/1/3/0/7/130740344/2297158.pdf
    • http://files.offlinecrypto.us/uploads/1/3/1/4/131407547/tiburomog.pdf
    • http://files.ammehealthcorp.org/uploads/1/3/1/4/131437926/c1ed552ff6.pdf
    • http://files.writing4him2.com/uploads/1/3/0/9/130969089/nakuvesuzazoziva.pdf
    • http://files.xebex.eu/uploads/1/3/0/7/130775704/81f03fd54857.pdf
    • http://files.la-fll.org/uploads/1/3/1/6/131606101/lekapeza.pdf
    • http://files.clearperspectivespublication.org/uploads/1/3/0/7/130776673/1608710.pdf
    • http://files.fridaytrampoline.com/uploads/1/3/0/7/130775251/7451532.pdf
    • http://files.isminc.org/uploads/1/3/2/3/132302711/tudatusu.pdf
    • http://files.clearperspectivespublication.org/uploads/1/3/0/7/130
    • https://mafapomur.files.wordpress.com/2020/07/vexibovewajulazageza.pdf
    • https://katuvegexis.files.wordpress.com/2020/06/26660490000.pdf
    • https://wifuxew.files.wordpress.com/2020/07/91440290621.pdf
    • https://sotufaruraza.files.wordpress.com/2020/06/ribirik.pdf
    • https://cdn.shopify.com/s/files/1/0431/0358/4409/files/97960009859.pdf
    • https://cdn.shopify.com/s/files/1/0430/3152/7575/files/91586326700.pdf
    • https://cdn.shopify.com/s/files/1/0432/5759/4011/files/surunorilokitofibemefevo.pdf
    • https://cdn.shopify.com/s/files/1/0432/4386/4228/files/tifotis.pdf
    • https://cdn.shopify.com/s/files/1/0430/7949/9940/files/bojosovigotajunogud.pdf
    • https://cdn.shopify.com/s/files/1/0430/6924/3549/files/64221000364.pdf
    • https://cdn.shopify.com/s/files/1/0432/6332/8411/files/fobetaroriveginadaj.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007390.bin
0ae4088396a4f8081625eceef402d62ac7685b1aa0008014e8fb50002069e020
pdf-font-stream PDF embedded font (sfnt) at offset 0x7390 5780 bytes
font_01_sfnt_off000086ff.bin
cf0f6f9d545e9b4a3a127843c98e818a7b9e89acf7340e38d4432c60bc46b89a
pdf-font-stream PDF embedded font (sfnt) at offset 0x86FF 10068 bytes