Malicious PDF — malware analysis report

Static analysis result for SHA-256 cd4216093a1a7803…

MALICIOUS

PDF

39.1 KB Created: 2020-08-12 23:49:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6d2a2856a35d87b712ccf40ee28f4d71 SHA-1: ef0ae3d3979f996ce748ec9ed9291f3df44889dd SHA-256: cd4216093a1a7803683c4e0a6a8de87281155e11f4a330f4a82fc9d8b9b8371e
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a prominent link to 'ttraff.com' which is flagged as a malicious redirector, disguised with keywords related to 'Amazon Kindle support'. The document also exhibits a link farm pattern, with numerous links pointing to PDFs hosted on Shopify and other domains, suggesting an attempt to manipulate search engine results or distribute malicious content. The presence of these links and the deceptive content indicates a likely phishing or malware distribution attempt.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=amazon+kindle+support+pdf
    • http://files.kyleedavid.com/uploads/1/3/1/4/131453733/nuwizukibor-banaloxur-wufanojoxe-fazelox.pdf
    • http://files.goldentreasureconsulting.co.uk/uploads/1/3/2/7/132740275/mizekoxobegipa.pdf
    • http://files.thecornerbutcher.com/uploads/1/3/0/7/130776447/gugoritapilimax.pdf
    • https://cdn.shopify.com/s/files/1/0435/4726/3128/files/legiwonudaxixor.pdf
    • https://cdn.shopify.com/s/files/1/0432/9367/1590/files/27438219399.pdf
    • https://cdn.shopify.com/s/files/1/0437/1962/2808/files/supizupojepapepap.pdf
    • https://cdn.shopify.com/s/files/1/0432/3367/3380/files/46261439411.pdf
    • https://cdn.shopify.com/s/files/1/0427/8029/5334/files/zodadesezupivoveverixe.pdf
    • https://cdn.shopify.com/s/files/1/0433/8099/8302/files/boyolali_dalam_angka.pdf
    • https://cdn.shopify.com/s/files/1/0435/3720/3364/files/mac_os_x_sierra_virtualbox.pdf
    • https://cdn.shopify.com/s/files/1/0438/1245/4560/files/8682459203.pdf
    • https://cdn.shopify.com/s/files/1/0434/4355/2416/files/zenanizo.pdf
    • https://cdn.shopify.com/s/files/1/0429/9587/5993/files/rasibifipixoba.pdf
    • https://cdn.shopify.com/s/files/1/0438/3142/7234/files/guboso.pdf
    • https://cdn.shopify.com/s/files/1/0435/2029/5064/files/48996501455.pdf
    • https://cdn.shopify.com/s/files/1/0427/9071/5548/files/mofagujat.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004bbe.bin
f9e89640f38e9ee8ea6c136b0854b6ffd963fde886bcbec21369c6845399d1bc
pdf-font-stream PDF embedded font (sfnt) at offset 0x4BBE 5172 bytes
font_01_sfnt_off00005d38.bin
87b0d1542292f110aeb4d50dfa00f43a55433cd3966d8860b1fbac57e7d1b9d0
pdf-font-stream PDF embedded font (sfnt) at offset 0x5D38 10664 bytes
font_02_sfnt_off0000819c.bin
05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176
pdf-font-stream PDF embedded font (sfnt) at offset 0x819C 4324 bytes