Malicious PDF — malware analysis report

Static analysis result for SHA-256 e45294d576f31703…

MALICIOUS

PDF

118.2 KB Created: 2020-09-11 13:51:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7ba550a7b66e270c624136bc8ab79bdc SHA-1: 24f6f6269e59ee48c01930d94ff62a1fad20d1c6 SHA-256: e45294d576f31703ba4b33100861509d73076288cd10feae3f6a94bf7d40efc8
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'ttraff.com'. The document body, though heavily obfuscated, contains the same URL and text suggesting it's a lure for a 'multicultural education thesis pdf'. This indicates the document is designed to trick users into visiting a malicious site, likely for phishing or malware delivery.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wb?keyword=multicultural%20education%20thesis%20pdf
    • https://cdn.shopify.com/s/files/1/0434/3123/1637/files/nesotemapumud.pdf
    • https://cdn.shopify.com/s/files/1/0431/8950/2111/files/bukuviroxopuv.pdf
    • https://cdn.shopify.com/s/files/1/0434/1239/0038/files/23642501749.pdf
    • https://cdn.shopify.com/s/files/1/0429/2132/8807/files/98267420920.pdf
    • https://cdn.shopify.com/s/files/1/0431/2619/4333/files/2000_nissan_pathfinder_repair_manual_free_download.pdf
    • https://cdn.shopify.com/s/files/1/0435/0168/2843/files/career_guidance_after_12th_commerce.pdf
    • https://cdn.shopify.com/s/files/1/0430/0649/2823/files/differential_calculus_by_asin.pdf
    • https://cdn.shopify.com/s/files/1/0431/2052/5469/files/cisco_9300l_data_sheet.pdf
    • https://cdn.shopify.com/s/files/1/0445/1749/0847/files/64722004956.pdf
    • https://cdn.shopify.com/s/files/1/0432/3141/2379/files/65758927855.pdf
    • https://cdn.shopify.com/s/files/1/0432/3947/3314/files/63033817559.pdf
    • https://cdn.shopify.com/s/files/1/0432/9160/7204/files/sheet_metal_coating_types.pdf
    • https://cdn.shopify.com/s/files/1/0434/4994/2176/files/51169805309.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00018bbd.bin
f8c9169c051313aa92ffe1d4b9bd1c88f656b5111a34e8b0b708cc9bf1d00a40		 pdf-font-stream PDF embedded font (sfnt) at offset 0x18BBD 5248 bytes
font_01_sfnt_off00019d99.bin
ed613f5710369b3ae4c9e5d2bf66c05c8a65fac1cb0da1f5e15d9119f939fa53		 pdf-font-stream PDF embedded font (sfnt) at offset 0x19D99 14828 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.