Malicious PDF — malware analysis report

Static analysis result for SHA-256 e534f98d8f2fcf24…

MALICIOUS

PDF

36.1 KB Created: 2020-09-16 17:51:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 45dd06746e14420f63fd90726be3367d SHA-1: 96c0372b1234faa74c2ace869876cb5d954ee7bd SHA-256: e534f98d8f2fcf24749a82aaff4e9444bc94b747f3e7e7e2c08d048a04756c0e
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, a technique often used to create SEO spam or to redirect users to malicious sites. One of the primary links, 'https://ttraff.me/wix?keyword=kansas+babe+ruth+baseball', is flagged as malicious. The document body contains garbled text but includes the malicious URL and other PDF links, suggesting a lure to a malicious redirector.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=kansas+babe+ruth+baseball
    • http://files.sackindnesscampaign.org/uploads/1/3/2/7/132740873/2397938.pdf
    • http://kadime.gonzalesmastergardeners.org/uploads/1/3/1/3/131378776/2064923.pdf
    • https://9ab944d5-d5c7-4318-9431-146bb98118ee.filesusr.com/ugd/decf6f_796073112b3d486bad2a2c8636d26978.pdf?index=true
    • https://35663acb-9e6f-451a-ac89-a99db9715fd6.filesusr.com/ugd/64bd79_db38cf96ab434b73a9a426db291e4375.pdf?index=true
    • https://4be2117b-eded-4df8-93c9-0fe5cabce3c1.filesusr.com/ugd/b8c837_6e6b41f35e7342a0840280422ef3ff17.pdf?index=true
    • https://cdn.shopify.com/s/files/1/0428/2135/3635/files/39421679551.pdf
    • https://cdn.shopify.com/s/files/1/0427/8052/4710/files/13394085356.pdf
    • https://cdn.shopify.com/s/files/1/0434/0151/1068/files/12542019897.pdf
    • https://cdn.shopify.com/s/files/1/0432/6722/7811/files/inmate_police_report.pdf
    • https://cdn.shopify.com/s/files/1/0434/0118/3384/files/tapolepikokizizafa.pdf
    • https://cdn.shopify.com/s/files/1/0432/2299/1007/files/cancer_genetics_book.pdf
    • https://cdn.shopify.com/s/files/1/0429/5399/8489/files/1490818621.pdf
    • https://cdn.shopify.com/s/files/1/0430/6095/3249/files/terraria_lucky_coin.pdf
    • https://cdn.shopify.com/s/files/1/0439/9867/5102/files/capitalization_paragraph_worksheet.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004fe2.bin
6ab783e566cbbba3920dda011287d7489af5c05d8a92a2340a06b240de446db0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4FE2 4884 bytes
font_01_sfnt_off00006078.bin
0fa127e96ce1d891003a99a46281239de30aec4e999aaa834c29f320e0da4451		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6078 10344 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.