Malicious PDF — malware analysis report

Static analysis result for SHA-256 a57fdef0ebd9a9c3…

MALICIOUS

PDF

44.4 KB Created: 2020-09-18 23:12:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6675146ee6ac443c39dbe63b82d9dd6a SHA-1: 365840ab5d754cd9e9c713580f49bd845eb20bb6 SHA-256: a57fdef0ebd9a9c3659ba9973a9c77781c1e4009662f015b68db5541f3feb801
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links, a technique often used to create link farms for SEO manipulation or to obscure malicious destinations. One of the primary links, 'https://ttraff.me/wix?keyword=j.+david+cooper+biografia', is flagged as a malicious redirector. The document body, though heavily obfuscated, contains this URL and other PDF links, suggesting the intent is to direct the user to malicious or compromised content.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=j.+david+cooper+biografia
    • http://files.nineteen09gifts.com/uploads/1/3/1/4/131482886/6728eac01d.pdf
    • http://jedeninov.kids4akinderamerica.com/uploads/1/3/0/8/130814340/zuxelinolumu.pdf
    • https://1b18a8ef-70da-4bde-ab59-a6541588812f.filesusr.com/ugd/50988c_df9e339328244fb28d01f8c67047f838.pdf?index=true
    • https://a8da361f-4c5e-4a30-8541-aa5dc953863b.filesusr.com/ugd/c5d40f_d5d978ba50304f99b33f0e30251766a3.pdf?index=true
    • https://1f3c2282-68b7-4d66-9dc7-9b6f004d2626.filesusr.com/ugd/590778_ac8a2da858b048048583444faa87ebe1.pdf?index=true
    • https://cdn.shopify.com/s/files/1/0479/6153/8727/files/meiosis_worksheet_answers_key.pdf
    • https://cdn.shopify.com/s/files/1/0435/6312/2843/files/elemental_shaman_leveling_talents.pdf
    • https://cdn.shopify.com/s/files/1/0438/4541/9165/files/virat_kohli_biosketch.pdf
    • https://cdn.shopify.com/s/files/1/0482/9164/3553/files/desolupunaweganipawe.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/damegadunuje.pdf
    • https://cdn.shopify.com/s/files/1/0433/0445/2246/files/99692068333.pdf
    • https://cdn.shopify.com/s/files/1/0432/8954/2809/files/40498249858.pdf
    • https://cdn.shopify.com/s/files/1/0432/3934/2247/files/wows_jutland_guide.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006eab.bin
f91383bc31a04b91a4ca8dde8244c8f441198db5a2b308725358829b62d84d86		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6EAB 5336 bytes
font_01_sfnt_off000080f0.bin
bd26c1c8a269b39b9bc136a0058bde2432fef1ff3c0ceed746c5db3e0bb2160d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x80F0 10948 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.