Malicious PDF — malware analysis report

Static analysis result for SHA-256 cd9002ff2fbd8275…

MALICIOUS

PDF

44.4 KB Created: 2020-07-23 13:07:17 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 487d552c451b27a4c5e893f9ad319904 SHA-1: 6b4037c230fadf276ebe3875828b206e7c02b143 SHA-256: cd9002ff2fbd8275f31fb5a3d747950cc1c92e0a788ce1e19d18e09eaaa81d90
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.001 User Execution: Malicious Link T1598.003 URL/Domain: Link Predication

The PDF file contains a critical heuristic firing for a malicious redirector link, pointing to 'ttraff.cc'. Additionally, it exhibits a PDF SEO link farm behavior, embedding 17 external PDF links, with the first pointing to a Shopify domain. The document also employs a social engineering lure, instructing the user to install a browser extension or update to view content. These elements collectively indicate a malicious intent to redirect users to potentially harmful sites or to manipulate search engine results.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=charlie+puth+i+warned+myself
    • http://files.mucklaghns.ie/uploads/1/3/1/8/131856624/nudibat-ziruboz-pediperer.pdf
    • http://files.fhwellness-ca.com/uploads/1/3/2/3/132302940/vejoxisajefolet.pdf
    • http://files.mandmcattlecompany.com/uploads/1/3/1/3/131381553/8842180.pdf
    • http://files.revolutionsigning.com/uploads/1/3/1/3/131378779/xojufuzu.pdf
    • https://cdn.shopify.com/s/files/1/0434/5249/8070/files/daxowugelosawuzetewozesu.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/voriwatovetizejewadodo.pdf
    • https://cdn.shopify.com/s/files/1/0434/1540/4695/files/83725489024.pdf
    • https://cdn.shopify.com/s/files/1/0433/7981/8661/files/55837603316.pdf
    • https://cdn.shopify.com/s/files/1/0428/5346/6271/files/52339987616.pdf
    • https://cdn.shopify.com/s/files/1/0431/6761/3082/files/kufosa.pdf
    • https://cdn.shopify.com/s/files/1/0433/4557/6088/files/vadupeke.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/vixegenosevisime.pdf
    • https://cdn.shopify.com/s/files/1/0431/2386/7805/files/kixojiworasez.pdf
    • https://cdn.shopify.com/s/files/1/0431/3802/3581/files/fajabatupivemuzazet.pdf
    • https://cdn.shopify.com/s/files/1/0439/0954/6136/files/buvebagezetuloribolun.pdf
    • https://cdn.shopify.com/s/files/1/0435/1331/5480/files/wexofet.pdf
    • https://cdn.shopify.com/s/files/1/0429/5095/1066/files/3477655008.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000066c2.bin
b917c55a39659f4582abae68e2b1f148c4d0b4ba752f52f2ffc7d69b5db2805d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x66C2 5268 bytes
font_01_sfnt_off00007891.bin
e49512ea4fc1bc7a32932e84bf73e497c485206c5b51083f3da5ce49d0731be8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7891 10648 bytes
font_02_sfnt_off00009cd4.bin
74be5bc4d46f64e5c506ae1006f7022dc98ebf960e37c7bf417c2027ca73106d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9CD4 1736 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.