Malicious PDF — malware analysis report

Static analysis result for SHA-256 e2a21cd9e1091a04…

MALICIOUS

PDF

41.8 KB Created: 2020-08-22 05:02:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 471760e8c0f50311a7c43e3159f3fe0b SHA-1: 1b528a3e636d32986dd63da244ca001da130cc09 SHA-256: e2a21cd9e1091a0435c64924989da4b83a4f2633fbc828a7809ff2e7b2162acd
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains numerous embedded links, many of which point to known malicious redirectors or potentially malicious domains. The heuristic 'PDF_MALICIOUS_REDIRECTOR_LINK' indicates a direct link to malicious infrastructure. The 'PDF_SEO_LINK_FARM' heuristic suggests the document is designed to artificially inflate search engine rankings by linking to many external PDFs, likely as a distribution or redirection mechanism. The embedded URL 'https://ttraff.com/pify?keyword=glencoe+mathematics+algebra+2+pdf' is a primary indicator of malicious intent, likely serving as a lure to a phishing or malware distribution site.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=glencoe+mathematics+algebra+2+pdf
    • http://xoroj.pobny.com/uploads/1/3/1/8/131871578/vonefedigudabema.pdf
    • http://pelased.profi-solar.com/uploads/1/3/1/6/131637257/nuronoxuxuza_fevisudodizid_dolunoxoxego.pdf
    • http://roximex.stonegrooveband.co.uk/uploads/1/3/1/1/131164250/470450.pdf
    • http://vonelo.apwindowsuk.co.uk/uploads/1/3/1/6/131637257/fizufovon-vowimi.pdf
    • http://files.petrilloskaratecampus.com/uploads/1/3/1/1/131163599/8748188.pdf
    • https://cdn.shopify.com/s/files/1/0431/5840/5275/files/86641162255.pdf
    • https://cdn.shopify.com/s/files/1/0434/5351/3880/files/masezitukobujepaja.pdf
    • https://cdn.shopify.com/s/files/1/0432/3514/7933/files/pmi_agile_certified_practitioner.pdf
    • https://cdn.shopify.com/s/files/1/0434/1117/7639/files/citizenship_test_questions_and_answers_2019_audio.pdf
    • https://cdn.shopify.com/s/files/1/0430/0737/7567/files/nuvil.pdf
    • https://cdn.shopify.com/s/files/1/0434/1540/4702/files/the_well_educated_mind.pdf
    • https://cdn.shopify.com/s/files/1/0437/9875/7538/files/tebogapogufanepedox.pdf
    • https://cdn.shopify.com/s/files/1/0432/9383/5432/files/woxugo.pdf
    • https://cdn.shopify.com/s/files/1/0434/6649/0006/files/fegavo.pdf
    • https://cdn.shopify.com/s/files/1/0436/8737/9094/files/acs_practice_exam_organic_chemistry.pdf
    • https://cdn.shopify.com/s/files/1/0436/1682/9603/files/joomla_template_zip_file.pdf
    • https://cdn.shopify.com/s/files/1/0428/6113/3990/files/wii_games_wads.pdf
    • http://www.macromedia.com/go/getflashplayer
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000055c1.bin
7d5ccf6e11faee482f2ee76c1577ad3e1afc3878fcfe5917f7e6c1b9a3ec5fcb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x55C1 5660 bytes
font_01_sfnt_off000068c7.bin
af1ef88ab7138d71ff9f29122818229af7f4f44633a05750abceb43095c7b444		 pdf-font-stream PDF embedded font (sfnt) at offset 0x68C7 10428 bytes
font_02_sfnt_off00008c40.bin
05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8C40 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.