Malicious PDF — malware analysis report

Static analysis result for SHA-256 d74ca902f8cffa49…

MALICIOUS

PDF

40.4 KB Created: 2020-09-01 02:15:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 40baf759d5291195d650d6202b8ae9e0 SHA-1: 2680001bfb7366a509c2d72c783344fa7174603f SHA-256: d74ca902f8cffa49c91b1e2951fbb9a17fac0a51e2f33bd02d31198213257f20
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links, many of which point to Shopify domains, but one specific URL, 'https://ttraff.cc/pify?keyword=oyster+3+carrycot+sheets', is flagged as a malicious redirector. The document body, though heavily obfuscated, contains references to product names and the malicious URL, suggesting a lure to a phishing or scam page. The presence of numerous links, including the malicious one, indicates a link farm or redirection strategy.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=oyster+3+carrycot+sheets
    • https://cdn.shopify.com/s/files/1/0431/3926/8770/files/amity_affliction_drag_the_lake.pdf
    • https://cdn.shopify.com/s/files/1/0463/9073/9099/files/ardaas_karan_full_movie_free.pdf
    • https://cdn.shopify.com/s/files/1/0433/0625/4494/files/dexejazatigifiba.pdf
    • https://cdn.shopify.com/s/files/1/0436/1306/1277/files/persona_5_electric_chair_unlock.pdf
    • https://static.usrfiles.com/ugd/b8c837_23a6596119524cc8bfee711c6534483c.pdf
    • https://cdn.shopify.com/s/files/1/0439/4021/6987/files/27074040111.pdf
    • https://cdn.shopify.com/s/files/1/0430/1016/2837/files/bobamozija.pdf
    • https://cdn.shopify.com/s/files/1/0430/8893/7120/files/86902714371.pdf
    • https://cdn.shopify.com/s/files/1/0436/4884/3934/files/tedajelov.pdf
    • https://cdn.shopify.com/s/files/1/0433/2647/2345/files/davowibetapaziw.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006035.bin
814c063964a464603e176d6a83f993c7a0695776e735d160b52986460b188d5f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6035 5148 bytes
font_01_sfnt_off000071b6.bin
08fdb27f69eee85ac11c5e542c8b9a1e561bc1d0948fbdc165c814adabaa844d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x71B6 10524 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.