Malicious PDF — malware analysis report

Static analysis result for SHA-256 a70345449307314a…

MALICIOUS

PDF

32.4 KB Created: 2020-08-13 18:47:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7843605aeb5561a1f0734781933fa028 SHA-1: 3edc5e3a25a702d621f1116c362a80cf2b0610d9 SHA-256: a70345449307314a62bd64693de7a0c08143fe8d1a64d7eedee93eba7e48160b
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a significant number of embedded URLs, with a critical heuristic firing indicating a link farm and a redirector. The primary malicious URL identified is 'https://ttraff.com/wb?keyword=weller%20wtcp-s%20pdf', which is likely used for malicious redirection. The document body itself is largely unreadable binary data, but the presence of numerous links suggests a social engineering or SEO-spamming attack pattern.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wb?keyword=weller%20wtcp-s%20pdf
    • http://files.teaspott.com/uploads/1/3/0/8/130873903/595979.pdf
    • http://lejaxe.13thdistrictofohio.org/uploads/1/3/1/4/131407089/fec55cd4ebf9f85.pdf
    • http://files.charliecalvert.net/uploads/1/3/0/8/130874205/dalenixedigozuk-sagirejimeba-kasiwigexiju-lixed.pdf
    • http://zefex.wdspa.com/uploads/1/3/2/6/132682883/dimitivisoteja_vitelanu_wipaxaguwubu_famopub.pdf
    • https://cdn.shopify.com/s/files/1/0428/8030/3270/files/xusisogajowebil.pdf
    • https://cdn.shopify.com/s/files/1/0436/2944/5273/files/arduino_uno_r3_specs.pdf
    • https://cdn.shopify.com/s/files/1/0435/3464/7445/files/osrs_dwarf_cannon_quest.pdf
    • https://cdn.shopify.com/s/files/1/0452/8803/0370/files/maths_logical_reasoning_questions_with_answers.pdf
    • https://cdn.shopify.com/s/files/1/0433/5150/7112/files/44549232465.pdf
    • https://cdn.shopify.com/s/files/1/0431/0781/1482/files/sozutuxate.pdf
    • https://cdn.shopify.com/s/files/1/0431/0587/8170/files/91398896754.pdf
    • https://cdn.shopify.com/s/files/1/0433/7333/0593/files/zuxizixitaxomimotenezegek.pdf
    • https://cdn.shopify.com/s/files/1/0431/2875/0241/files/justice_will_not_be_served.pdf
    • https://cdn.shopify.com/s/files/1/0428/0070/9791/files/pdf_marxisme_untuk_pemula.pdf
    • https://cdn.shopify.com/s/files/1/0428/5802/1027/files/44338847727.pdf
    • https://cdn.shopify.com/s/files/1/0428/1312/8871/files/26183412738.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004335.bin
ce1cee3108e2aa93f9a79121226bdf61c07165c44dc7552ad045a89a64d26027		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4335 5076 bytes
font_01_sfnt_off000054a8.bin
b10b03f766231546b23172a34d74c03300f34a242aa7200faf7863e85e6e12ef		 pdf-font-stream PDF embedded font (sfnt) at offset 0x54A8 9588 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.