Malicious PDF — malware analysis report

Static analysis result for SHA-256 b925da36e1d897ef…

MALICIOUS

PDF

36.4 KB Created: 2020-08-22 15:17:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5be797b46c2f29d2ff04c551cf6cb881 SHA-1: f9cef50ee6bbc31de7f7b20b2858d7e7487bbc73 SHA-256: b925da36e1d897efa5259abd524ef439a2f0723c11f690834666a6399910f240
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, many pointing to Shopify domains, but one critical link directs to a known malicious redirector at ttraff.com. The document body, though heavily obfuscated, contains the text 'Square root of 290 in radical form' and the malicious URL, suggesting a lure to disguise the malicious intent. The primary attack pattern involves directing users to malicious infrastructure via these embedded links.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=square+root+of+290+in+radical+form
    • http://files.seniorservicesofswfl.com/uploads/1/3/0/7/130775431/1023744.pdf
    • https://cdn.shopify.com/s/files/1/0436/8862/4283/files/zamomasemokoje.pdf
    • https://cdn.shopify.com/s/files/1/0429/6101/0842/files/fufowovopur.pdf
    • https://cdn.shopify.com/s/files/1/0431/4818/1666/files/37385456803.pdf
    • https://cdn.shopify.com/s/files/1/0432/8305/4757/files/foloxodod.pdf
    • https://cdn.shopify.com/s/files/1/0440/3652/2149/files/udp_tracker_leechers_paradise_org_6969.pdf
    • https://cdn.shopify.com/s/files/1/0433/5458/7288/files/vabezawo.pdf
    • https://cdn.shopify.com/s/files/1/0431/7075/8816/files/centrifugal_pump_preventive_maintenance_checklist.pdf
    • https://cdn.shopify.com/s/files/1/0431/4107/1016/files/13468529342.pdf
    • https://cdn.shopify.com/s/files/1/0437/1021/8391/files/suzogufamarixibojakuwapo.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004faf.bin
47a24461a61db0e694922e981c8e1d70dcfd728f30397b26a53448bae3c0f7e5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4FAF 5648 bytes
font_01_sfnt_off000062c9.bin
4aae384bf2adb61942795d1e80d6e3bdf71880d3423f50a3ff706a1f9dc785d3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x62C9 10160 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.