Malicious PDF — malware analysis report

Static analysis result for SHA-256 af066763a1a5c228…

MALICIOUS

PDF

38.6 KB Created: 2020-08-30 05:17:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fe318b05ca6640890d4303c1378f9a9c SHA-1: 8ca534f66bceb6de8420426ae06d4cebce5d941f SHA-256: af066763a1a5c228c890f7963b45dc5c59a9c96a74be0eacd2a4cd0bc595982e
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Phishing: Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, with a critical heuristic firing indicating a link farm and a redirector. One of the primary links points to a known malicious redirector at 'ttraff.com'. While many other links point to benign Shopify domains, the presence of the redirector and the sheer volume of links suggest a malicious intent, likely for SEO manipulation or to host further malicious content.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=future+simple+perfect+english+gramma
    • https://cdn.shopify.c
    • https://cdn.shopify.com/s/files/1/0435/5804/3807/files/examples_of_anecdotal_records_for_teachers.pdf
    • https://cdn.shopify.com/s/files/1/0434/0829/4044/files/89518630413.pdf
    • https://cdn.shopify.com/s/files/1/0433/7552/6042/files/37937298672.pdf
    • https://cdn.shopify.com/s/files/1/0438/2585/6672/files/pro_forma_income_statement_in_excel.pdf
    • https://cdn.shopify.com/s/files/1/0440/1371/5606/files/store_keeping_procedures.pdf
    • https://cdn.shopify.com/s/files/1/0430/4519/1841/files/rekeseto.pdf
    • https://cdn.shopify.com/s/files/1/0431/2917/6232/files/13316238986.pdf
    • https://cdn.shopify.com/s/files/1/0434/2933/1100/files/vatofiwowokimuvose.pdf
    • https://cdn.shopify.com/s/files/1/0433/6192/7318/files/97200160446.pdf
    • https://cdn.shopify.com/s/files/1/0434/8451/2418/files/84248294276.pdf
    • https://cdn.shopify.com/s/files/1/0439/5306/2043/files/32029786123.pdf
    • https://cdn.shopify.com/s/files/1/0460/6518/9019/files/29921954508.pdf
    • https://cdn.shopify.com/s/files/1/0429/2309/8279/files/bamaluvuwofelapogivoxibe.pdf
    • https://cdn.shopify.com/s/files/1/0447/8438/6199/files/capital_cities_of_the_world.pdf
    • https://cdn.shopify.com/s/files/1/0430/6668/7642/files/92647712173.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000594b.bin
76ab36535631a74fb5a90495994810911d5cb262f1e872d8d9cc46d4a53ea965		 pdf-font-stream PDF embedded font (sfnt) at offset 0x594B 5384 bytes
font_01_sfnt_off00006b71.bin
c60404253e6af1e12b3cbab210492cdc3d7c263a9daa1a8c6e17159076416393		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6B71 9896 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.