Malicious PDF — malware analysis report

Static analysis result for SHA-256 afbf056a1d986278…

MALICIOUS

PDF

43.5 KB Created: 2020-09-05 14:08:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7e0aa2700fd1d95ce17ec835c354d886 SHA-1: e53f7574fede6fc1b3b0b9db134b767698195f09 SHA-256: afbf056a1d98627845cbd2c6940e7825d37cb43a8512cbfa5af0c9f1609078bf
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'ttraff.club'. Additionally, it exhibits a PDF link farm with numerous external links, many hosted on Shopify, suggesting an attempt to obscure the malicious destination. The embedded JavaScript stream and the document body's mention of 'insurance adjuster exam study guide' further support a lure-based attack pattern.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/pify?keyword=insurance+adjuster+exam+study+guide
    • https://cdn.shopify.com/s/files/1/0431/1236/6229/files/vimaxikovumas.pdf
    • https://cdn.shopify.com/s/files/1/0427/6961/2966/files/classe_anthozoa.pdf
    • https://cdn.shopify.com/s/files/1/0430/1789/6089/files/georgia_8th_grade_social_studies_study_guide.pdf
    • https://cdn.shopify.com/s/files/1/0465/1519/1958/files/operating_agreement_template_word.pdf
    • https://cdn.shopify.com/s/files/1/0441/4416/5016/files/medical_terms_a_z.pdf
    • https://static.usrfiles.com/ugd/8716ab_78ca3409d4034826a934e5b22ecc55e6.pdf
    • https://static.usrfiles.com/ugd/fd7405_e5e407cd6e9f4212b0378e6cdd323b5b.pdf
    • https://cdn.shopify.com/s/files/1/0428/3141/3414/files/sorigirowiraxosatemon.pdf
    • https://cdn.shopify.com/s/files/1/0429/2149/2643/files/risukunovexefubiru.pdf
    • https://cdn.shopify.com/s/files/1/0460/3310/9156/files/alcatel_one_touch_pop_c3_firmware.pdf
    • https://cdn.shopify.com/s/files/1/0464/6076/4312/files/magento_2_override_order_email_template.pdf
    • https://cdn.shopify.com/s/files/1/0441/0405/6984/files/dokawedubemilisomovalosag.pdf
    • https://cdn.shopify.com/s/files/1/0437/3220/5722/files/didonakipakupatiz.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000604a.bin
dc8d1ae929db36f4bb31e924e781374a1deec40288dd193f72e5a81446148b85
pdf-font-stream PDF embedded font (sfnt) at offset 0x604A 5184 bytes
font_01_sfnt_off000071d5.bin
907ec44f98aae79f6a6fc9c0d7ae731fe69eb8799c56ca78e4ad8f457ca1f1fe
pdf-font-stream PDF embedded font (sfnt) at offset 0x71D5 9840 bytes
font_02_sfnt_off00009378.bin
a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f
pdf-font-stream PDF embedded font (sfnt) at offset 0x9378 4324 bytes