Malicious PDF — malware analysis report

Static analysis result for SHA-256 d0a88ee3b70e904f…

MALICIOUS

PDF

47.7 KB Created: 2020-08-30 05:20:26 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7662ae55a1292c2bb6332d87eedff79d SHA-1: 480c5b43f58298dbcd0ff6b12403ad3b5c5c1b01 SHA-256: d0a88ee3b70e904fa4d819185e2e46ab8aff90adbb9bb236da2c835e3ce55bcd
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains numerous embedded links, with a critical heuristic firing for a malicious redirector. The primary link directs to a URL containing 'ttraff.link', a known malicious redirector, which then attempts to lead the user to download content. Another heuristic indicates a PDF link farm, with many links pointing to Shopify domains, likely for SEO manipulation to increase visibility of malicious content. The document body contains text related to 'statistics for management and economics 11th edition pdf free download' and a call-to-action phrase, reinforcing the lure.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/wix?keyword=statistics+for+management+and+economics+11th+edition+pdf+free+download
    • https://cdn.shopify.com/s/files/1/0433/9141/8526/files/koi_aap_sa_full_hd_video.pdf
    • https://cdn.shopify.com/s/files/1/0462/4475/7655/files/sazapurure.pdf
    • https://cdn.shopify.com/s/files/1/0435/7442/7806/files/91323637371.pdf
    • https://cdn.shopify.com/s/files/1/0436/9969/9866/files/84239081267.pdf
    • https://cdn.shopify.com/s/files/1/0432/0926/1220/files/buwarimejigurulikudidux.pdf
    • https://cdn.shopify.com/s/files/1/0437/2443/9704/files/baidu_cloud_app.pdf
    • https://cdn.shopify.com/s/files/1/0430/8454/6209/files/percy_jackson_graphic_novel_download.pdf
    • https://cdn.shopify.com/s/files/1/0430/8166/2628/files/kilakudodagekapufuvux.pdf
    • https://cdn.shopify.com/s/files/1/0434/0393/5900/files/4002033783.pdf
    • https://cdn.shopify.com/s/files/1/0433/4764/0469/files/29802349360.pdf
    • https://static.usrfiles.com/ugd/b8c837_60b4d206c38c471dbc1e33b39cfaf50f.pdf
    • https://static.usrfiles.com/ugd/b8c837_1089c6a8614948b79ff195f8fdd50e4e.pdf
    • https://static.usrfiles.com/ugd/de3d83_310ffca51fab43b8b1eb686aabb2abd9.pdf
    • https://static.usrfiles.com/ugd/b8c837_8432177643f44956bbf81b136dba065b.pdf
    • https://static.usrfiles.com/ugd/e3ed1f_da4d3382e330462d9a8d450a12d783e2.pdf
    • https://static.usrfiles.com/ugd/b8c837_c773afb0a1c040b3abcb07471c7f7c08.pdf
    • https://static.usrfiles.com/ugd/b8c837_1de87f838e7b449388f40ad979f462a4.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006c1b.bin
cdebf1439121b21e1e64f2819341fa41c530ac1f273f7efb37f1566b67a1c8a3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6C1B 3132 bytes
font_01_sfnt_off00007759.bin
e7e6d39be1cf8e8d55e27b7dac27e9a2d4df2b3ef16bcf521d795f2c250ee5de		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7759 5816 bytes
font_02_sfnt_off00008b00.bin
d7806aa3291a36ea6b237a62e659c37c401839ae22fb90d17f355ca09650a668		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8B00 10528 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.