Malicious PDF — malware analysis report

Static analysis result for SHA-256 9ea32e2d9a227513…

MALICIOUS

PDF

41.9 KB Created: 2020-08-05 11:09:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8d98fd7ff5eef135252a871e456ed903 SHA-1: aa467ef47d78b6689572ff70bcd830fbbfd1b79c SHA-256: 9ea32e2d9a227513a1cbb2ede7f3f353b57c3b2606154f2fd56189e3c0cb477b
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a heuristic firing for a malicious redirector link, pointing to 'https://ttraff.cc/pify?keyword=distributed+scrum+agile+project+management+with+outsourced+development+teams+pdf'. It also contains a link farm heuristic, with numerous embedded links to PDF files, many hosted on Shopify. The primary malicious link appears to be the redirector, likely intended to lead the user to a further malicious destination.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=distributed+scrum+agile+project+management+with+outsourced+development+teams+pdf
    • http://files.mariachiacademyne.org/uploads/1/3/0/8/130873907/738d8823a0fa.pdf
    • http://files.theleantrainer.co.uk/uploads/1/3/1/3/131383319/tizojijowad-jiril.pdf
    • http://files.chocolatesyn.com/uploads/1/3/1/3/131379382/kodarajaxip-rilejafolaro-fabinen-lexeko.pdf
    • http://files.keynshamcricket.com/uploads/1/3/0/7/130739510/sifanebupe.pdf
    • http://files.annaephoto.com/uploads/1/3/0/7/130775145/9688182.pdf
    • https://cdn.shopify.com/s/files/1/0434/1320/9246/files/gavab.pdf
    • https://cdn.shopify.com/s/files/1/0435/3048/5912/files/41090458036.pdf
    • https://cdn.shopify.com/s/files/1/0430/4135/7973/files/varugaritesutomexijovo.pdf
    • https://cdn.shopify.com/s/files/1/0431/1662/6082/files/tikulimuxixakujo.pdf
    • https://cdn.shopify.com/s/files/1/0437/6097/6021/files/72622606371.pdf
    • https://cdn.shopify.com/s/files/1/0431/6335/3244/files/sort_vector_c.pdf
    • https://cdn.shopify.com/s/files/1/0433/1382/3909/files/17978123093.pdf
    • https://cdn.shopify.com/s/files/1/0434/0806/4677/files/lelatamu.pdf
    • https://cdn.shopify.com/s/files/1/0428/6195/3191/files/riroduvigus.pdf
    • https://cdn.shopify.com/s/files/1/0430/0151/2095/files/2018_chevy_equinox_owners_manual.pdf
    • https://cdn.shopify.com/s/files/1/0431/4162/8072/files/bopozufedivexevavexefa.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006275.bin
1391fc175d928971b2b9aba2544d9841b1ed27e7f99f12872ba2acb236b69334		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6275 5936 bytes
font_01_sfnt_off0000769c.bin
a6178ebd41fd52ac98db5af7ebed0fc0ba72f26146f661f0d706f975a9686bbc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x769C 10308 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.