Malicious PDF — malware analysis report

Static analysis result for SHA-256 aa4bd72700d0d889…

MALICIOUS

PDF

46.0 KB Created: 2020-08-14 03:11:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3a5f823809c1114b4905e5f2aa150b68 SHA-1: 347596a2682e31c050b23def27ba899586a4fe22 SHA-256: aa4bd72700d0d8899db2c0bed25d2c8c29c4536f07b3b11db1dd4cdd778bf0c1
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF file contains a heuristic firing for a malicious redirector link pointing to 'https://ttraff.cc/pify?keyword=arabic+logo+maker+free'. This URL is presented within the document body, disguised as a free logo maker tool. The file also exhibits characteristics of a link farm, with numerous external PDF links, many hosted on cdn.shopify.com. The presence of a malicious redirector suggests a phishing or scam attempt designed to lead the user to a harmful site.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=arabic+logo+maker+free
    • http://files.darlingcharacterparties.com/uploads/1/3/2/6/132695719/lupajidegolug.pdf
    • http://files.srnelson.com/uploads/1/3/2/6/132682471/b1dcb0b.pdf
    • http://files.pshigodagirlsfarm.com/uploads/1/3/1/4/131437149/7210251.pdf
    • http://files.perciakwedding.com/uploads/1/3/1/3/131398164/9951377.pdf
    • http://files.daviessbaseball.com/uploads/1/3/1/4/131437563/6411205.pdf
    • https://cdn.shopify.com/s/files/1/0430/4211/1650/files/credit_union_definition.pdf
    • https://cdn.shopify.com/s/files/1/0432/1142/3902/files/duzebatokojivurotuxidefow.pdf
    • https://cdn.shopify.com/s/files/1/0433/3384/5150/files/22247666864.pdf
    • https://cdn.shopify.com/s/files/1/0429/4190/7110/files/catalina_22_owners_manual.pdf
    • https://cdn.shopify.com/s/files/1/0430/2936/4889/files/vijegoponoxovuvasowi.pdf
    • https://cdn.shopify.com/s/files/1/0433/0304/3230/files/cost_accounting_guerrero_solution_manual_2020.pdf
    • https://cdn.shopify.com/s/files/1/0433/0084/7781/files/converter_em_word_gratuito_candy.pdf
    • https://cdn.shopify.com/s/files/1/0431/2589/9421/files/25477125651.pdf
    • https://cdn.shopify.com/s/files/1/0429/8702/8641/files/propiedades_de_los_metales_alcalinoterreos.pdf
    • https://cdn.shopify.com/s/files/1/0430/4764/9429/files/restoration_ecology_textbook.pdf
    • https://cdn.shopify.com/s/files/1/0429/3056/9382/files/wudetororo.pdf
    • https://cdn.shopify.com/s/files/1/0432/7571/4715/files/ffxiv_player_commendation.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://cdn.shopify.com/s/files/1/0430/2936

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006827.bin
25a69b7ce3b46ce4ff2b1bf8e1d914f6b55d3bb96ace42c5601bff5c30e29dff		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6827 4816 bytes
font_01_sfnt_off00007880.bin
17f11369d68c4c463eaeeb3da0dd9426259608d15b85c5ba40eec48b0f7c5f55		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7880 10592 bytes
font_02_sfnt_off00009ca4.bin
b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9CA4 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.