Malicious PDF — malware analysis report

Static analysis result for SHA-256 b15100bfd5e4143b…

MALICIOUS

PDF

57.0 KB Created: 2020-08-29 15:56:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 85c330d5ff9f3cd6e1c58afcf9613556 SHA-1: d3b0399c4cfa0a703b01440dc46b85da78e54ffd SHA-256: b15100bfd5e4143ba75b32bc95da5b0986a39a35b8347a9f7205ab627cf9a1cd
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a heuristic firing for a malicious redirector link, specifically pointing to 'https://ttraff.com/wix?keyword=sthreedhanam+malayalam+movie'. Additionally, it exhibits characteristics of a PDF link farm, with numerous embedded links, many of which point to Shopify domains. The document body, though heavily obfuscated, also contains the primary malicious URL. No scripts were extracted from this sample.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=sthreedhanam+malayalam+movie
    • https://cdn.shopify.com/s/files/1/0434/0298/5622/files/kefeposifud.pdf
    • https://cdn.shopify.com/s/files/1/0431/0712/3357/files/nowixizezopovesi.pdf
    • https://cdn.shopify.com/s/files/1/0428/5058/2684/files/wapobusukoralilalame.pdf
    • https://static.usrfiles.com/ugd/b8c837_9fef6998794846d1a3f7112cc3b3cd04.pdf
    • https://static.usrfiles.com/ugd/b8c837_2d49632ee9294ca1a27a9e31d8779245.pdf
    • https://static.usrfiles.com/ugd/b8c837_7ad786902dad40529b6f5a4242697e70.pdf
    • https://static.usrfiles.com/ugd/bf650e_2eedd018e7714ff29a33103faa807cd9.pdf
    • https://cdn.shopify.com/s/files/1/0438/8965/5960/files/zamadosatipowiviza.pdf
    • https://cdn.shopify.com/s/files/1/0435/1744/4264/files/15309071036.pdf
    • https://static.usrfiles.com/ugd/b8c837_5e363015ff504085a3de576f5df0ec33.pdf
    • https://static.usrfiles.com/ugd/b8c837_cc679750b13547dd99d7637bdc02d937.pdf
    • https://static.usrfiles.com/ugd/b8c837_cd358dfc61e540668b4d35995bce5230.pdf
    • https://static.usrfiles.com/ugd/77d535_9f79799449fe4e4fa0f9331ba70454b0.pdf
    • https://static.usrfiles.com/ugd/b8c837_88251c5cf7af4a6bbbae50137896aeeb.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000063fd.bin
ca821cd1b1b45076f9bd8312f068e3ded936f66f87e6d56313ec354eaacf090a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x63FD 4940 bytes
font_01_sfnt_off00007494.bin
5dcdea0bb080a6cbd030c3263c0d55baf2da9aab39e26a28ea163da1750a2c3f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7494 4436 bytes
font_02_sfnt_off00008394.bin
32352e69a1d533ae425267c778be56525f81be51c5e5e522524bbb64fec67575		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8394 4720 bytes
font_03_sfnt_off000094c9.bin
cdd50a41e549daf645ba1b40703a0a1c5f8ce1993e6a117dd6a3aab716ddc0ce		 pdf-font-stream PDF embedded font (sfnt) at offset 0x94C9 4264 bytes
font_04_sfnt_off0000a481.bin
b4a18eb5542209f4ddd2512900712e47c2ea67150c77de725f85786f4663845f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA481 10388 bytes
font_05_sfnt_off0000c7be.bin
a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC7BE 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.