Malicious PDF — malware analysis report

Static analysis result for SHA-256 a100a0be8daf4f6a…

MALICIOUS

PDF

46.3 KB Created: 2020-07-30 20:25:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 650ef2c4f9f26969983019f18e25f7b3 SHA-1: a306642c050879c1c295bd26b77ff207fb538b32 SHA-256: a100a0be8daf4f6a52dd916cc71040f3b7625895dc5fb6f3b0c57d487ef7e6f7
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links, many of which point to a redirector service (ttraff.cc) and are likely intended to lead users to malicious content. The heuristic PDF_MALICIOUS_REDIRECTOR_LINK specifically flags the link to ttraff.cc, indicating it is part of known malicious infrastructure. The PDF_SEO_LINK_FARM heuristic further supports this by identifying a mass external PDF link farm, suggesting an attempt to manipulate search engine results or distribute malicious links broadly. No scripts were extracted, and the document body was heavily corrupted, making it difficult to ascertain the exact lure, but the link farm and redirector are strong indicators of a phishing or malware distribution attempt.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=reading+comprehension+worksheets+pdf+grade+11
    • http://files.64trainingsystems.com/uploads/1/3/0/7/130776204/0af3518f200fc.pdf
    • http://files.bethlehemctcommunitygarden.org/uploads/1/3/1/8/131858916/9150946.pdf
    • http://files.inlandempireinjurylaw.com/uploads/1/3/1/3/131380546/537162.pdf
    • http://files.michellerampulla.com/uploads/1/3/1/4/131454216/pafafufik.pdf
    • http://files.authormelaniejames.com/uploads/1/3/1/6/131606563/lolatotaxiz-batirixuburaxu-bomaw.pdf
    • http://files.inlandempireinjurylaw
    • https://cdn.shopify.com/s/files/1/0431/5840/5276/files/nakekuxupor.pdf
    • https://cdn.shopify.com/s/files/1/0434/1625/6677/files/xirodukajajegagiki.pdf
    • https://cdn.shopify.com/s/files/1/0434/6108/3301/files/ronawenexoker.pdf
    • https://cdn.shopify.com/s/files/1/0430/3552/5282/files/30429693293.pdf
    • https://cdn.shopify.com/s/files/1/0430/1009/7313/files/gukopogibibubitil.pdf
    • https://cdn.shopify.com/s/files/1/0433/2696/3865/files/wiwuzivepajatoketawirut.pdf
    • https://cdn.shopify.com/s/files/1/0429/6943/2230/files/rezokinuxuvonowidudalimef.pdf
    • https://cdn.shopify.com/s/files/1/0432/5674/2046/files/99687965478.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/kekesapenogetiru.pdf
    • https://cdn.shopify.com/s/files/1/0434/9168/8610/files/gafalaz.pdf
    • https://cdn.shopify.com/s/files/1/0432/7673/0528/files/jizanorelulik.pdf
    • https://cdn.shopify.com/s/files/1/0432/3305/0779/files/69591675230.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000769a.bin
3683ee56ad2fec71a2a540dc1af272c69b3642ffc6c25a54f8e79ebd6c5f590b
pdf-font-stream PDF embedded font (sfnt) at offset 0x769A 5540 bytes
font_01_sfnt_off00008959.bin
7e08e43e65d31a0f0120008b9418b7429befc35d61d0565bd3d872532d325781
pdf-font-stream PDF embedded font (sfnt) at offset 0x8959 10100 bytes