PDF malware analysis — malicious · ca401b7340116d47

MALICIOUS

PDF

48.5 KB Created: 2020-07-31 03:35:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 494e44c608e8001cd5a12dba5185d58d SHA-1: 79cebcd7f2bf10ac993fc6414351ade3e1cc6688 SHA-256: ca401b7340116d47643a88b0afef28204a5479760ae88143dd3752620394244b

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a heuristic firing for a malicious redirector link, pointing to 'ttraff.cc'. This URL is presented within the document body, disguised as a worksheet answer key, likely to lure users into clicking it. The PDF also exhibits characteristics of a link farm, with numerous external links, many hosted on Shopify. The primary malicious IOC is the redirector URL.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wb?keyword=mole%20to%20mole%20stoichiometry%20worksheet%20answer%20key
- http://files.loganfamilycenter.org/uploads/1/3/1/0/131071056/dibexaruguvejetulon.pdf
- http://files.khloekares.com/uploads/1/3/0/9/130969989/97e718e1830f7.pdf
- http://files.yourvitality.co/uploads/1/3/1/1/131164012/xesugajisotowag.pdf
- http://files.shenyle.biz/uploads/1/3/0/7/130740391/mupoloxu-gevoveli-dorozu-ropifeso.pdf
- http://files.shenyle.biz
- https://cdn.shopify.com/s/files/1/0432/8531/5737/files/20912502196.pdf
- https://cdn.shopify.com/s/files/1/0435/1465/8980/files/23616182698.pdf
- https://cdn.shopify.com/s/files/1/0432/4930/3720/files/mukulawutufakawakugaxi.pdf
- https://cdn.shopify.com/s/files/1/0431/7007/0690/files/31111216766.pdf
- https://cdn.shopify.com/s/files/1/0429/5321/2057/files/dikizavogimuwanugaxuxivo.pdf
- https://cdn.shopify.com/s/files/1/0427/8494/8380/files/kumojovofopasitasizad.pdf
- https://cdn.shopify.com/s/files/1/0430/1137/5267/files/sadizus.pdf
- https://cdn.shopify.com/s/files/1/0431/3962/9218/files/vofefozagofawofagolor.pdf
- https://cdn.shopify.com/s/files/1/0433/6127/1959/files/62736734235.pdf
- https://cdn.shopify.com/s/files/1/0434/7982/6582/files/dofofaganetodamow.pdf
- https://cdn.shopify.com/s/files/1/0431/7259/3821/files/99206291597.pdf
- https://cdn.shopify.com/s/files/1/0430/1576/6177/files/47042828682.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/mejamuzeditika.pdf
- https://cdn.shopify.com/s/files/1/0432/3826/0903/files/goxikeweruxenamatume.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000777b.bin` `7f53675e0f3e4d2f91a1f1b7dbb171f4ea5c0119ccdd33ea8b04f1d50d96a421`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x777B	5092 bytes
`font_01_sfnt_off000088b5.bin` `0cf31c62b48e7f2d8de91ee691e8ebe99d187d8d77f87a036e93758d5b2268a4`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x88B5	13056 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.