Malicious PDF — malware analysis report

Static analysis result for SHA-256 b62f271ce3cf1112…

MALICIOUS

PDF

46.9 KB Created: 2020-08-29 13:27:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 41850d41a7e6b80f237bb7e5a8425f8e SHA-1: 10590d7aa52e410756d864919ff567f907295a0c SHA-256: b62f271ce3cf11125af6058a1e00404ddf8363bd67ab9e38e4432a1266f05115
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a heuristic firing for a malicious redirector link, which is also present in the document body. This link, 'https://ttraff.link/wix?keyword=naturally+triple+your+testosterone+p', is designed to lure users with a deceptive promise. The file also contains a PDF link farm, with many links pointing to benign Shopify domains, likely for SEO manipulation. The primary malicious IOC is the ttraff.link redirector.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/wix?keyword=naturally+triple+your+testosterone+p
    • https://cdn.shopify.com/s/files/1/0432/0133/1360/files/gitivusawita.pdf
    • https://cdn.shopify.com/s/files/1/0431/6132/1634/files/38948222172.pdf
    • https://cdn.shopify.com/s/files/1/0431/2065/6545/files/17968147361.pdf
    • https://cdn.shopify.com/s/files/1/0436/7056/9113/files/fegotubasa.pdf
    • https://cdn.shopify.com/s/files/1/0448/6584/7458/files/matplotlib._use_agg.pdf
    • https://cdn.shopify.com/s/files/1/0428/3367/4396/files/nizilakekituxararopowu.pdf
    • https://cdn.shopify.com/s/files/1/0461/9691/6374/files/bill_nye_the_science_guy_motion.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/mituvazejuremoposanizama.pdf
    • https://cdn.shopify.com/s/files/1/0431/5326/0701/files/limpiar_imei_telcel.pdf
    • https://cdn.shopify.com/s/files/1/0434/0098/6787/files/photosynthesis_in_c3_c4_and_cam_plants.pdf
    • https://cdn.shopify.com/s/files/1/0433/3764/6245/files/nexetetosavum.pdf
    • https://cdn.shopify.com/s/files/1/0429/3787/6639/files/callaway_great_big_bertha_alpha_adjustment_guide.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/74832969368.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006da5.bin
569a0e9018f3f5730c8ad3b55943368cd7bce6a375d975afc6303fdc19c0816c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6DA5 4764 bytes
font_01_sfnt_off00007dea.bin
9588b52306ee41dd75246f978e224666a4ebfe2be37ff0c0d1cece3af6b6229b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7DEA 10256 bytes
font_02_sfnt_off0000a0ee.bin
ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA0EE 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.