Malicious PDF — malware analysis report

Static analysis result for SHA-256 c7d9d886258bb035…

MALICIOUS

PDF

44.8 KB Created: 2020-08-23 05:53:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 610eccd6b9fc50455a80f416e59f8812 SHA-1: 881f21f911294e82610f1f25991341f4b94e9769 SHA-256: c7d9d886258bb035c153110ef0049a6913e0aa5063cc103bf7ce34e62375c668
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF was flagged for containing a malicious redirector link and a large number of external PDF links, suggesting a link farm or SEO manipulation tactic. The primary malicious URL identified is ttraff.com, which is known for redirecting to potentially harmful content. The document body contains garbled text along with the malicious URL and several Shopify-hosted PDF links, some of which are confirmed benign but others are unknown. No scripts were extracted from this sample.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=create+gaming+logo+template
    • http://files.futurestarsathletics.com/uploads/1/3/1/8/131858044/xojizivaninireborak.pdf
    • http://lekago.thechaneymanorbb.com/uploads/1/3/2/7/132740405/8659951.pdf
    • http://gegimi.fortheboysblog.com/uploads/1/3/0/8/130814328/jijilifewep.pdf
    • http://pumowu.speedysracingparts.com/uploads/1/3/1/8/131871390/nafelakupomaze.pdf
    • https://cdn.shopify.com/s/files/1/0445/4265/6671/files/ap_calculus_notes.pdf
    • https://cdn.shopify.com/s/files/1/0428/1221/1359/files/child_and_adolescent_development_for_educators_second_edition.pdf
    • https://cdn.shopify.com/s/files/1/0439/8009/5646/files/56125665568.pdf
    • https://cdn.shopify.com/s/files/1/0430/0416/6297/files/31085364099.pdf
    • https://cdn.shopify.com/s/files/1/0433/2807/7992/files/divina_commedia_inferno.pdf
    • https://cdn.shopify.com/s/files/1/0436/1024/3229/files/dadik.pdf
    • https://cdn.shopify.com/s/files/1/0432/9881/6150/files/1853585517.pdf
    • https://cdn.shopify.com/s/files/1/0433/3400/8987/files/dafokuwulalonesupidijo.pdf
    • https://cdn.shopify.com/s/files/1/0437/7369/0017/files/reading_comprehension_worksheets_for_kindergarten.pdf
    • https://cdn.shopify.com/s/files/1/0434/7245/3797/files/8861132955.pdf
    • https://cdn.shopify.com/s/files/1/0429/8611/1137/files/wowuwurulabunub.pdf
    • https://cdn.shopify.com/s/files/1/0437/6798/8376/files/fazisa.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000072ae.bin
ecd9d2d4bcd7e9112855399cb54a7c857681a145f7cef670d2105ee819403ac1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x72AE 4864 bytes
font_01_sfnt_off00008322.bin
435cdd109a434669d6e05ebd1e6220ee899610e202a3d2af9adc4a2905072f80		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8322 10304 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.