Malicious PDF — malware analysis report

Static analysis result for SHA-256 d8eca3a6597505fe…

MALICIOUS

PDF

40.7 KB Created: 2020-09-01 00:55:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: abdba65b344fff48a30031a029022255 SHA-1: 66e30cfe8652953395f72fa1684e1f1e5854705c SHA-256: d8eca3a6597505fe1cd903728013bbb89f467d65b4bfb288db2cd6078da63a56
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a malicious redirector link disguised as a search result for "hd cartoon wallpapers 1080p full". This link, https://ttraff.cc/wix?keyword=hd+cartoon+wallpapers+1080p++full, is flagged as malicious and likely leads to further compromise. The document also contains a large number of other embedded links, many pointing to Shopify, which is characteristic of SEO link farm abuse to obscure malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=hd+cartoon+wallpapers+1080p++full
    • https://static.usrfiles.com/ugd/b13fd1_5ece542174f34275a9d2f4518b61f298.pdf
    • https://static.usrfiles.com/ugd/ca300b_066206880bef47048b436fbdfd711c24.pdf
    • https://static.usrfiles.com/ugd/b8c837_e4f7ac90e6dd4d6b9195487a5d661922.pdf
    • https://static.usrfiles.com/ugd/b8c837_7a2a6f31a632415b9c76541145582218.pdf
    • https://static.usrfiles.com/ugd/3e9e83_31f9e781a3584dbfa4aad4eac4233c19.pdf
    • https://static.usrfiles.com/ugd/b11f6d_54e1c128f18649bf99491b59679a190c.pdf
    • https://cdn.shopify.com/s/files/1/0437/0841/6168/files/amoeba_sisters_classification.pdf
    • https://cdn.shopify.com/s/files/1/0432/5585/7315/files/81426222732.pdf
    • https://cdn.shopify.com/s/files/1/0439/0017/4504/files/lagalifamesitosofaf.pdf
    • https://cdn.shopify.com/s/files/1/0434/8801/8594/files/gukove.pdf
    • https://cdn.shopify.com/s/files/1/0428/6991/5814/files/55583465901.pdf
    • https://cdn.shopify.com/s/files/1/0431/8602/8708/files/subaru_owner_manuals.pdf
    • https://cdn.shopify.com/s/files/1/0428/3406/7615/files/7779710873.pdf
    • https://cdn.shopify.com/s/files/1/0468/8550/3133/files/86505503548.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005f9d.bin
0876daac4cce4fe6705a97fd8052abe39071375b8c669eb6036afbf2b388bf5f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5F9D 5592 bytes
font_01_sfnt_off000072c9.bin
fb3d2e3c988ef33879d36d6a2cb522ed36b8426292bbaf83477b874647fcfc5b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x72C9 10324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.