Malicious PDF — malware analysis report

Static analysis result for SHA-256 9efe7d4d618fe664…

MALICIOUS

PDF

46.9 KB Created: 2020-09-01 07:48:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c2d7e6eff1bce97028d0d3dd6ab1f44b SHA-1: ca536b7b1259d177ff900ec24f7af14b19616f29 SHA-256: 9efe7d4d618fe6649040ba1603a2aba40cd0189b508702b824376aa3c5c367c1
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a significant number of embedded links, identified as a link farm. The primary malicious link, https://ttraff.com/wix?keyword=occupational+health+and+safety+alberta+pdf, is a known malicious redirector. The document body appears to be malformed or obfuscated, but the presence of numerous links to external PDFs, many hosted on cdn.shopify.com, suggests a coordinated effort to distribute malicious content or conduct phishing attacks.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=occupational+health+and+safety+alberta+pdf
    • https://static.usrfiles.com/ugd/1c8c6c_b616dd5b928b4817a32743edb2dcbf19.pdf
    • https://static.usrfiles.com/ugd/b8c837_e28f30ce82144481a06ca84e8cbf376e.pdf
    • https://static.usrfiles.com/ugd/ca300b_475fff88d457466cb4079de84d573259.pdf
    • https://static.usrfiles.com/ugd/fb5067_61a780a6661d4f8cbe67bb9c599edc1f.pdf
    • https://cdn.shopify.com/s/files/1/0429/5042/6780/files/file_l_g.pdf
    • https://cdn.shopify.com/s/files/1/0432/9573/5976/files/56614148625.pdf
    • https://cdn.shopify.com/s/files/1/0433/1687/1336/files/xikako.pdf
    • https://cdn.shopify.com/s/files/1/0431/9857/8848/files/laraniroridaponivev.pdf
    • https://cdn.shopify.com/s/files/1/0434/6226/2936/files/99682801861.pdf
    • https://cdn.shopify.com/s/files/1/0428/7099/7151/files/a_level_physics_edexcel_textbook.pdf
    • https://cdn.shopify.com/s/files/1/0440/5349/5958/files/95859572189.pdf
    • https://cdn.shopify.com/s/files/1/0440/6162/2437/files/soxax.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/vepotarinaf.pdf
    • https://cdn.shopify.com/s/files/1/0435/2219/5607/files/aha_guidelines_atrial_fibrillation_2017.pdf
    • https://cdn.shopify.com/s/files/1/0434/5865/8469/files/baixar_livros_gratis_em_passei_direto.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007924.bin
181e43254210ee60103370e6fdd619c4543f00cdc3599fb0e354dd8172a4b1bb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7924 5512 bytes
font_01_sfnt_off00008bd6.bin
66773b0a197225517c52cfa652891e9a115f844f145c6bab0049caeb94569902		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8BD6 10308 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.