Malicious PDF — malware analysis report

Static analysis result for SHA-256 bdd53913db16c4d1…

MALICIOUS

PDF

43.6 KB Created: 2020-08-19 13:39:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3c6ed987b1f9c46317dc237c5f51c29a SHA-1: c5f9a91450da1b12142ac6623aee357ef56ac1b0 SHA-256: bdd53913db16c4d18f3dafc0b86cdfe1f68b42e3743f8c63ee7c9fc0b8505d57
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a mass external link farm, with many links pointing to Shopify domains, likely for SEO manipulation. One critical heuristic identified a PDF redirector link to 'ttraff.cc', which is known malicious infrastructure. The document body contains the phrase 'Full form of bsf' and the malicious URL, suggesting a lure to a phishing or malware distribution site.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=full+form+of+bsf
    • http://files.ohiooutdoorstructures.com/uploads/1/3/1/6/131606965/rejibubezad_visabojaniw.pdf
    • https://cdn.shopify.com/s/files/1/0437/1234/8315/files/types_of_commercial_aircraft.pdf
    • https://cdn.shopify.com/s/files/1/0434/5197/3799/files/beauty_and_the_beast_piano.pdf
    • https://cdn.shopify.com/s/files/1/0436/7224/0293/files/fedewivifawarun.pdf
    • https://cdn.shopify.com/s/files/1/0429/3502/5831/files/ccs_medical_attendance_rules_1944.pdf
    • https://cdn.shopify.com/s/files/1/0436/2996/9561/files/l_adjectif_possessif_exercices.pdf
    • https://cdn.shopify.com/s/files/1/0428/9275/5103/files/daguv.pdf
    • https://cdn.shopify.com/s/files/1/0434/5361/2199/files/towetovameruzedavifuke.pdf
    • https://cdn.shopify.com/s/files/1/0435/7364/1379/files/agonia_significado.pdf
    • https://cdn.shopify.com/s/files/1/0430/1350/5185/files/push_git_to_github.pdf
    • https://cdn.shopify.com/s/files/1/0431/0571/4338/files/baruwajo.pdf
    • https://cdn.shopify.com/s/files/1/0462/6746/5890/files/baby_sleeping_bag_guide_nhs.pdf
    • https://cdn.shopify.com/s/files/1/0434/4646/8769/files/45892158153.pdf
    • https://cdn.shopify.com/s/files/1/0437/5491/3950/files/malusowutusiwukusosabum.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000614b.bin
421f15132842bbee14f19a5d0e94354006981ea14bb2e60b4c35c13c3be33ecd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x614B 4328 bytes
font_01_sfnt_off00006ff0.bin
8d5b8297ceff20132129027ed93bc5e8fa7d544da7baef27b6aed10acd2148d5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6FF0 10488 bytes
font_02_sfnt_off000093e6.bin
9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x93E6 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.