Malicious PDF — malware analysis report

Static analysis result for SHA-256 c155d51ea484da86…

MALICIOUS

PDF

68.1 KB Created: 2020-09-02 22:43:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5711f02284ea83b52c104ed43e4e5f34 SHA-1: 2a7098516c9ec1f51e5b0eb4e0c66d21b0c0d55e SHA-256: c155d51ea484da86931297ad982f360c20545e9810ec437ccaf571ba8388ad40
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a heuristic firing for a malicious redirector link, specifically pointing to 'https://ttraff.link/wix?keyword=boss+telugu+movie+ringtones'. Additionally, it exhibits characteristics of a PDF link farm, embedding numerous external links, with the first identified link being 'https://cdn.shopify.com/s/files/1/0432/6844/0224/files/bhaktapur_map.pdf'. The document body, though heavily obfuscated, contains text related to 'Boss telugu movie ringtones' and the redirector URL, suggesting a lure to a malicious site.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/wix?keyword=boss+telugu+movie+ringtones
    • https://cdn.shopify.com/s/files/1/0432/6844/0224/files/bhaktapur_map.pdf
    • https://cdn.shopify.com/s/files/1/0432/7328/9888/files/ankle_osteoarthritis_exercises.pdf
    • https://cdn.shopify.com/s/files/1/0434/0668/8412/files/68371262638.pdf
    • https://cdn.shopify.com/s/files/1/0466/2591/5045/files/jiwelubawomuzirunimate.pdf
    • https://cdn.shopify.com/s/files/1/0462/3099/5095/files/edvantage_science_ap_chemistry_2.pdf
    • https://static.usrfiles.com/ugd/c63dba_0568241839454aee98da3c84449dad62.pdf
    • https://static.usrfiles.com/ugd/b8c837_ba1f802286d44e0090a49df6032326b3.pdf
    • https://static.usrfiles.com/ugd/eda9ba_0f6a042456ca4e5d876bf315a4c4aab1.pdf
    • https://static.usrfiles.com/ugd/99965f_7d98a71a3a224c389818bc13eb9ef73f.pdf
    • https://cdn.shopify.com/s/files/1/0433/9105/8076/files/opsc_assistant_section_officer_previous_question_papers.pdf
    • https://cdn.shopify.com/s/files/1/0428/8384/2215/files/10359516775.pdf
    • https://cdn.shopify.com/s/files/1/0435/4326/5434/files/54183645516.pdf
    • https://cdn.shopify.com/s/files/1/0433/8457/0019/files/comparing_percents_fractions_and_decimals_worksheet.pdf
    • https://cdn.shopify.com/s/files/1/0435/4398/6327/files/db_2013_pg_22557-_22559.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://cdn.shopify.com/s/files/1/0435/4398/6327/files/db_

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d2d6.bin
d5ae5617b33d0827b818b1300b481fa26e2ab1ab4a52dd30c8e963f66d0fc045		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD2D6 4904 bytes
font_01_sfnt_off0000e37c.bin
514496afab6281090fbb0c8480079af1d1738eef8df5389eb840fd81bde474c0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE37C 9388 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.