Malicious PDF — malware analysis report

Static analysis result for SHA-256 bea8aa220f05769e…

MALICIOUS

PDF

51.1 KB Created: 2020-09-16 18:31:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4d83c3a71128ba888d6a3d9ab207e808 SHA-1: a353caca855f68d9950d0dd6bac1732cc91487af SHA-256: bea8aa220f05769eab6301cfd5c44c0fdc25942aee2c19ef607c30a2614c5427
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a significant number of embedded URLs, with a critical heuristic firing indicating it's a malicious redirector link farm. The primary malicious URL identified is https://ttraff.me/wix?keyword=science+olympiad+rules+manual+division+b, which is likely used to obscure the final destination of the attack. The document body itself contains garbled text but also includes the same malicious URL and a benign-looking Shopify URL, suggesting a lure to disguise the malicious intent. No scripts were extracted, but the extensive use of redirectors points to a phishing or malware distribution attempt.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=science+olympiad+rules+manual+division+b
    • https://cdn.shopify.com/s/files/1/0483/6137/3847/files/81606611180.pdf
    • https://cdn.shopify.com/s/files/1/0460/7233/2452/files/nikulanobegiwedaxalezoret.pdf
    • https://cdn.shopify.com/s/files/1/0437/8597/8018/files/c._g_comedy_film.pdf
    • https://cdn.shopify.com/s/files/1/0432/9704/6681/files/kenak.pdf
    • https://cdn.shopify.com/s/files/1/0451/1576/8985/files/12699527073.pdf
    • https://cdn.shopify.com/s/files/1/0437/9957/6733/files/annotate_documents_free.pdf
    • https://cdn.shopify.com/s/files/1/0462/7342/9661/files/salatamoneriravavewovup.pdf
    • https://cdn.shopify.com/s/files/1/0438/3752/2085/files/a_tale_of_three_kings.pdf
    • https://cdn.shopify.com/s/files/1/0438/2628/2658/files/extracting_dna_from_kiwi_worksheet.pdf
    • https://a87d5c8d-596b-4476-bce5-69f0da6712e5.filesusr.com/ugd/c268f7_91cb4654ba444975b39c6fe3472c2551.pdf?index=true
    • https://4f5a3ba4-36d7-4e4c-bbc9-9adbf8efcf79.filesusr.com/ugd/aec2ea_aa180cfccfe24492aa153d65f8296a3e.pdf?index=true
    • https://352fa173-86ff-4658-a37e-9588cb942524.filesusr.com/ugd/2eedf1_4390732260dd48ab9149ce1f409c9783.pdf?index=true
    • https://ac033be8-226c-46f5-904a-0b782e59ed79.filesusr.com/ugd/65b209_6be44c7c24394313a5da9cf2668030c8.pdf?index=true
    • https://92d8a0d6-5847-43ad-ab58-7e5139cdd328.filesusr.com/ugd/8e7730_3cfb1cd4434143eb9c34678d60fa6878.pdf?index=true
    • https://e9597e68-fe4d-4c6d-8df1-b8133856313c.filesusr.com/ugd/31593d_6dfd7ad87acb4c9ab8733a567b69de4e.pdf?index=true
    • https://1bf10450-84e3-4c07-a57c-8a5c57bc7457.filesusr.com/ugd/622218_43205bb1cfae404e808dc14fb35ce4fd.pdf?index=true
    • https://6e163fa8-ba6c-4304-8fef-dc969fb59510.filesusr.com/ugd/94e5ef_5823246051e54ea6b908d000e756f348.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://6e163fa8-ba6c-4304-8fef-dc969fb59510.filesusr.com/ugd/94e5ef_5823246051e54ea6b9

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000065d2.bin
706661447efd880df4b5fb7401be2a09902f2bc7b7b4c5b0a4b2a2581d0ad358		 pdf-font-stream PDF embedded font (sfnt) at offset 0x65D2 5424 bytes
font_01_sfnt_off0000780e.bin
ab5e9fddee16fae431a33ab40e0ca7d33f45100137646485f03412457aa18231		 pdf-font-stream PDF embedded font (sfnt) at offset 0x780E 10232 bytes
font_02_sfnt_off00009b60.bin
e93acd332f5893643511f4cefd38969ad5c744ad1b08842a788b6be7d277dd15		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9B60 16204 bytes
font_03_sfnt_off0000b08e.bin
4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB08E 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.