Malicious PDF — malware analysis report

Static analysis result for SHA-256 99cd5d07d0972604…

MALICIOUS

PDF

46.6 KB Created: 2020-08-06 15:17:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 79c353372df173b5416e4430ef3a45d8 SHA-1: 2a34ecf5e4d43c66cd674f09887280123dd7ff7f SHA-256: 99cd5d07d0972604d7a273603db4b8c3b8026c6fd8f210ed1b654be4a423c578
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a mass external link farm, with many links pointing to Shopify domains hosting other PDFs. One critical heuristic identified a link to a known malicious redirector, ttraff.cc, which is used to obscure the final destination. The document body text and embedded URLs suggest a lure for downloading 'aptitude questions', likely a pretext to redirect users to malicious sites.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=tcs+aptitude+questions+and+answers+with+explanation+pdf+free+download
    • http://files.mycbmc.com/uploads/1/3/1/0/131069899/4c11aa.pdf
    • http://jifal.amberlynnphotographyllc.com/uploads/1/3/0/8/130874655/tabovulowivodotopi.pdf
    • http://files.ballycastlehistory.com/uploads/1/3/0/9/130969139/0ad0002e636e.pdf
    • http://files.thebettajivereview.com/uploads/1/3/1/4/131438011/relur.pdf
    • https://cdn.shopify.com/s/files/1/0438/3365/5446/files/for_loop_c.pdf
    • https://cdn.shopify.com/s/files/1/0434/1619/1138/files/bixalulezivasuvenu.pdf
    • https://cdn.shopify.com/s/files/1/0430/3850/7169/files/00325-_95800-_00000-_aaoem.pdf
    • https://cdn.shopify.com/s/files/1/0428/3141/3404/files/87523625101.pdf
    • https://cdn.shopify.com/s/files/1/0433/8289/8840/files/bexedepejedokezo.pdf
    • https://cdn.shopify.com/s/files/1/0449/8151/8494/files/elektrik_arpmas_tedavisi.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/zamujogeve.pdf
    • https://cdn.shopify.com/s/files/1/0431/2757/0596/files/upkar_english_speaking_course_book_download.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/39720928980.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000075ff.bin
baca366d4888f56ebe308bf56bde058fb7192909700a0b6c3f61c03e79d8dd5d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x75FF 5480 bytes
font_01_sfnt_off000088b6.bin
e544360f6d341613107e049b0706e759c677502df170491801a3bf60cf05a961		 pdf-font-stream PDF embedded font (sfnt) at offset 0x88B6 10808 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.