Malicious PDF — malware analysis report

Static analysis result for SHA-256 a98bce326124692b…

MALICIOUS

PDF

40.8 KB Created: 2020-08-24 02:18:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 75dff064149417c8171eb9cecc62f6ed SHA-1: 053579e16b1a7f94942459c4c08739fea5308732 SHA-256: a98bce326124692bd5245d6a78c6680d90d2b7ce5a7618b24a6ae817c435091a
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was identified as malicious due to the presence of numerous embedded links. One critical heuristic firing indicates a PDF malicious redirector link pointing to 'ttraff.com', which is likely used to funnel users to malicious content. Another critical heuristic flags a PDF SEO link farm, with 13 external PDF links, suggesting an attempt to manipulate search results or distribute content across multiple domains. The document body contains text related to 'transformational leadership pdf' and includes the malicious URL, reinforcing the phishing or malicious redirection intent.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=characteristics+of+transformational+leadership+pdf
    • http://veretonu.orlandosanchezfilms.net/uploads/1/3/0/7/130738885/dalanesufabit_ziwizeriju_zenute.pdf
    • https://cdn.shopify.com/s/files/1/0431/2665/3090/files/pdf_a_dwg_di_cadsofttools.pdf
    • https://cdn.shopify.com/s/files/1/0429/7824/6815/files/83576950533.pdf
    • https://cdn.shopify.com/s/files/1/0435/7609/8975/files/xipebefuwovutiri.pdf
    • https://cdn.shopify.com/s/files/1/0431/8691/3439/files/nozegubegiliwif.pdf
    • https://cdn.shopify.com/s/files/1/0432/3776/9383/files/aceites_esenciales_y_sus_propiedades_teraputicas.pdf
    • https://cdn.shopify.com/s/files/1/0433/5206/4155/files/advanced_mathematical_thinking.pdf
    • https://cdn.shopify.com/s/files/1/0437/6281/1031/files/shell_script_lab_manual.pdf
    • https://cdn.shopify.com/s/files/1/0437/4416/6037/files/stepped_footing.pdf
    • https://cdn.shopify.com/s/files/1/0430/0649/2823/files/the_disappearance_of_edith_finch_trophy_guide.pdf
    • https://cdn.shopify.com/s/files/1/0429/9636/7511/files/2049513068.pdf
    • https://cdn.shopify.com/s/files/1/0432/5366/1851/files/94898083306.pdf
    • https://cdn.shopify.com/s/files/1/0434/8936/2082/files/luis_borges_el_aleph.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000063b3.bin
e178ed2b9c3e4836df6b07522416630209fffdcbfac34646b74595fe5ba7c4b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x63B3 5300 bytes
font_01_sfnt_off00007585.bin
3a8f4503fbf2b79707f7cb4f6f7df88e6233b02e7e5b4b7558757a9428fb3b10		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7585 9672 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.