Malicious PDF — malware analysis report

Static analysis result for SHA-256 c797476db8a42b7b…

MALICIOUS

PDF

51.3 KB Created: 2020-09-01 13:22:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 548b5ec54d742206247b9cfaa37a70ff SHA-1: 77b87c6acffa42a9553abd0ea365ef17d87bd436 SHA-256: c797476db8a42b7bf97ad2494f7f2232b26aa499d2a4b38a78ae0f6d49cccd2e
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, many of which point to Shopify domains hosting other PDFs, suggesting a link farm for SEO manipulation. One critical heuristic identified a link to 'ttraff.com', a known malicious redirector, which is further contextualized by the document body mentioning 'billiards city mod apk free'. This indicates a phishing or scam attempt to redirect users to malicious content.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=billiards+city+mod+apk+free
    • https://cdn.shopify.com/s/files/1/0434/8503/6708/files/bowewanakobipodinotima.pdf
    • https://cdn.shopify.com/s/files/1/0434/3398/4161/files/nolewafozod.pdf
    • https://cdn.shopify.com/s/files/1/0430/5554/6517/files/1575610544.pdf
    • https://cdn.shopify.com/s/files/1/0436/0273/9362/files/44669091949.pdf
    • https://cdn.shopify.com/s/files/1/0438/0036/3169/files/bixelebuvo.pdf
    • https://static.usrfiles.com/ugd/a64c8c_32537b68c5f844d792c5acae2ba8d529.pdf
    • https://static.usrfiles.com/ugd/b5472a_10e57df46fd84bcc8d50785e3212a42b.pdf
    • https://static.usrfiles.com/ugd/4117a9_1a7f4d010a7b49e0a4755b2a3f4a7a47.pdf
    • https://static.usrfiles.com/ugd/9cc572_4688018d60894881a96136948ca51932.pdf
    • https://static.usrfiles.com/ugd/b8c837_1e3d2afce0414796b97d8b1b9369c023.pdf
    • https://cdn.shopify.com/s/files/1/0438/4587/7922/files/guidewire_testing_tutorial.pdf
    • https://cdn.shopify.com/s/files/1/0430/0364/2007/files/credit_card_authorisation_form_prudential.pdf
    • https://cdn.shopify.com/s/files/1/0432/0156/0737/files/rabebobelusodajusap.pdf
    • https://static.usrfiles.com/ugd/be19e1_27495aa216b945fb954f99d19a0b6cfb.pdf
    • https://static.usrfiles.com/ugd/b8c837_aadb38ffb99442bab22c92120aec1acd.pdf
    • https://static.usrfiles.com/ugd/b8c837_876449ef327f4cc7a744b2149235bcaa.pdf
    • https://static.usrfiles.com/ugd/edb4a7_eeb9dce16cc44e4aa1a0f25359257db3.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006be3.bin
f5767ccdda8eaf911e9ef7b6b6f13143708386f6fe41cf7a76b0a2d0ad733d6c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6BE3 5516 bytes
font_01_sfnt_off00007e95.bin
8218a70c419dcaf866e13f50f76d12eb3bf8e0da277fe5ad1c5cf86d2e25f6b3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7E95 1832 bytes
font_02_sfnt_off00008762.bin
08bd005c91c5cbdd170e33ec9dda2aad5e25fc2127cbfd9b36779b15c08130a0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8762 10208 bytes
font_03_sfnt_off0000aa93.bin
18f56b7fae04e07bc119a468ad323bdda099da77b0772854d1c47cc1f39b9f3b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAA93 16144 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.