Malicious PDF — malware analysis report

Static analysis result for SHA-256 a7b1435ec1bdde54…

MALICIOUS

PDF

60.4 KB Created: 2020-08-23 08:05:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 94ace5d9f6d59a4e9874d5fbbc5bb43c SHA-1: a15aff916424cc2fb2db3ebfa001ffa02493128a SHA-256: a7b1435ec1bdde544dea7609e8c748add7bfb8e421366764e3bc2a8bcbd1a3b8
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF contains embedded JavaScript and a critical heuristic firing for a malicious redirector link pointing to 'ttraff.com'. Additionally, it features a link farm of 15 external PDF links, many hosted on Shopify, indicating a coordinated effort to distribute malicious content or phish users. The embedded JavaScript likely facilitates the redirection or further payload delivery.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=accurate+sentences+worksheets
    • http://files.1enchantedcraft.com/uploads/1/3/0/7/130775405/jigabilonabigu.pdf
    • http://xukinare.davidvaldezphotography.com/uploads/1/3/1/1/131164159/degaveje-gafetusis-duxedizitifed-narerunesaxide.pdf
    • http://files.onlineloan-payday.org/uploads/1/3/1/6/131606343/bawerefuxisemi.pdf
    • http://files.citysunholdings.com/uploads/1/3/2/8/132815343/26141917c3e27dd.pdf
    • http://files.jin-li.org/uploads/1/3/0/7/130775350/9bbe38388ff1701.pdf
    • http://files.citysunho
    • https://cdn.shopify.com/s/files/1/0428/2672/7580/files/pigudaxopi.pdf
    • https://cdn.shopify.com/s/files/1/0429/8421/0583/files/17909621290.pdf
    • https://cdn.shopify.com/s/files/1/0428/0591/9903/files/spotify_premium_crack.pdf
    • https://cdn.shopify.com/s/files/1/0428/8295/7478/files/buwali.pdf
    • https://cdn.shopify.com/s/files/1/0435/6957/8147/files/1181660466.pdf
    • https://cdn.shopify.com/s/files/1/0437/3633/4490/files/2735239371.pdf
    • https://cdn.shopify.com/s/files/1/0430/8277/6725/files/7454545228.pdf
    • https://cdn.shopify.com/s/files/1/0431/6043/6887/files/tepamelexoz.pdf
    • https://cdn.shopify.com/s/files/1/0431/7606/7228/files/98177266631.pdf
    • https://cdn.shopify.com/s/files/1/0434/8618/3576/files/18475765878.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007fc2.bin
8657c2ddf40625ff73042513dd917c4dc44fec227eb8d4a14fc3fce54b5152e0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7FC2 4832 bytes
font_01_sfnt_off0000902c.bin
4e28f851830aedb6ca71827e978b6f0925494350201f7b558316a64dfcb7f27c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x902C 15416 bytes
font_02_sfnt_off0000c07f.bin
532315dfdc59b350d447ad91845dd8cc72a836e684f536ab9a4305dc5b53fb8e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC07F 16204 bytes
font_03_sfnt_off0000d5af.bin
cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD5AF 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.