Malicious PDF — malware analysis report

Static analysis result for SHA-256 d40c604a460e9eee…

MALICIOUS

PDF

46.2 KB Created: 2020-08-11 00:28:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1785ae493cb965fb5e577561f9411356 SHA-1: a39b67a71a18d1294ab749c33dcf5568acb75178 SHA-256: d40c604a460e9eee5cffeddb25afc3f76ed375ca637ab986289d97d20cc08f7c
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF contains a heuristic firing for a malicious redirector link and a link farm, indicating a phishing or redirection attempt. The document body, though heavily obfuscated, contains text related to 'ansi z535 safety color chart pdf' and includes the malicious URL, suggesting a lure to trick users into clicking the link. The presence of multiple PDF links, many hosted on Shopify, further supports the link farm and potential SEO poisoning tactic. The primary malicious URL is ttraff.cc, which redirects to a payload.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=ansi+z535+safety+color+chart+pdf
    • http://files.asifthinkingmatters.com/uploads/1/3/1/3/131382018/gopejenokijema.pdf
    • http://files.labednbreakfast.com/uploads/1/3/0/7/130738805/nugilixesafud_wuralevukinuvov.pdf
    • http://dunufor.pandgdolls.net/uploads/1/3/0/7/130739415/ccc5a9.pdf
    • https://cdn.shopify.com/s/files/1/0434/1760/0152/files/98186115492.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/59044096386.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/23158701460.pdf
    • https://cdn.shopify.com/s/files/1/0429/8866/7034/files/ranegobifisuxafilalaw.pdf
    • https://cdn.shopify.com/s/files/1/0431/0515/7284/files/gen_6_pokedex.pdf
    • https://cdn.shopify.com/s/files/1/0435/2340/8032/files/wipatamawufavovadanonat.pdf
    • https://cdn.shopify.com/s/files/1/0430/4932/0610/files/94722597729.pdf
    • https://cdn.shopify.com/s/files/1/0438/4981/0070/files/33964703012.pdf
    • https://cdn.shopify.com/s/files/1/0430/5109/0077/files/guvub.pdf
    • https://cdn.shopify.com/s/files/1/0433/7418/2563/files/integer_to_string_c.pdf
    • https://cdn.shopify.com/s/files/1/0432/2259/7800/files/55228820040.pdf
    • https://cdn.shopify.com/s/files/1/0430/1045/7753/files/because_because_of_due_to.pdf
    • https://cdn.shopify.com/s/files/1/0429/6101/0842/files/pafax.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005f0b.bin
68de99a967a7552be4cc5d1b206b6f3e3355c063e136b08a7e00d4a0d10eef34		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5F0B 5460 bytes
font_01_sfnt_off00007193.bin
5bbfb71e7e79db7713d2dca3d61a529cd6bdf2162d19a91745b024a6fee9cfc1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7193 2048 bytes
font_02_sfnt_off00007a70.bin
a63d7009114d2644d4dc310ee4bf9b467c7c000b9686e631ca51d8a77a5dcca3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7A70 10168 bytes
font_03_sfnt_off00009d33.bin
1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9D33 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.