Malicious PDF — malware analysis report

Static analysis result for SHA-256 ce294bd7d564b1cc…

MALICIOUS

PDF

46.9 KB Created: 2020-08-10 18:50:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 79b40aedb2af5428e55ca46e284d648b SHA-1: 581a528e01d07c76820db2b0e3426ebd4abab0d2 SHA-256: ce294bd7d564b1ccebcffc790bc2498b7a4450e78c440c9a8eb4e36d122eadcd
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links, many pointing to Shopify domains, but one critical link directs to a known malicious redirector at ttraff.com. The document body, though heavily obfuscated, contains the URL https://ttraff.com/pify?keyword=cetostearyl+alcohol+msds+pdf, suggesting the document's purpose is to lure the user to this malicious site. The presence of numerous links indicates a potential SEO poisoning or link farm tactic to distribute malicious content.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=cetostearyl+alcohol+msds+pdf
    • http://files.kerryhawkinsphotography.com/uploads/1/3/0/9/130969357/lizimupararu.pdf
    • http://files.homeorganic.com/uploads/1/3/0/7/130739067/zoradewawab.pdf
    • http://files.watershedecology.org/uploads/1/3/2/3/132302736/e596bc382f9.pdf
    • https://cdn.shopify.com/s/files/1/0427/5562/1031/files/13792231927.pdf
    • https://cdn.shopify.com/s/files/1/0434/0416/5285/files/tafopujumenes.pdf
    • https://cdn.shopify.com/s/files/1/0449/0782/3259/files/90851920157.pdf
    • https://cdn.shopify.com/s/files/1/0440/1129/0782/files/49909641959.pdf
    • https://cdn.shopify.com/s/files/1/0434/3041/2454/files/84441491802.pdf
    • https://cdn.shopify.com/s/files/1/0427/5165/6102/files/9879705110.pdf
    • https://cdn.shopify.com/s/files/1/0435/4444/5082/files/apartheid_education_in_south_africa.pdf
    • https://cdn.shopify.com/s/files/1/0436/8482/3205/files/bibimipobapixobawiponi.pdf
    • https://cdn.shopify.com/s/files/1/0436/9963/4326/files/50227551807.pdf
    • https://cdn.shopify.com/s/files/1/0433/6081/3208/files/24277254498.pdf
    • https://cdn.shopify.com/s/files/1/0435/9448/1823/files/diagnostico_de_anemia_en_nios.pdf
    • https://cdn.shopify.com/s/files/1/0433/2378/5370/files/advantages_and_disadvantages_of_modern_technology_essay.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000078e8.bin
54246b25f2e533c9138325b4cf42f5d69a656bd8d6620f06b48fe8b6f0bd1d37		 pdf-font-stream PDF embedded font (sfnt) at offset 0x78E8 5404 bytes
font_01_sfnt_off00008b2c.bin
56cfcf27d89b77a7c8ce130c04e1f41bb3d6e665703f6501bf9edb5287fa0c93		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8B2C 10532 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.