Malicious PDF — malware analysis report

Static analysis result for SHA-256 e53856b19ca93e38…

MALICIOUS

PDF

53.8 KB Created: 2020-08-13 22:51:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 125d8a2f4a0f50183446a89d363646f9 SHA-1: 59133ebc8c2bc2e5b56284d42b806592e426529a SHA-256: e53856b19ca93e38f21cb23f589b8a5643d59e10150b00e0dcaab221e48108d3
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a heuristic firing for a malicious redirector link and a link farm, indicating it is designed to lead users to malicious websites. The document body, though heavily obfuscated, contains text that suggests a lure to install a browser extension or update. The primary malicious URL identified is ttraff.com, which is used in conjunction with a keyword related to a VPN, likely to entice users. The PDF also contains numerous links to Shopify-hosted PDFs, forming a link farm.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=hola+vpn+for+mac
    • http://files.lisascola.com/uploads/1/3/2/7/132741397/0d2ca4349cf.pdf
    • http://files.kotorprivatetours.com/uploads/1/3/1/0/131070938/dizekujavixi-setitanipadalar.pdf
    • http://files.davidlhoytfoundation.org/uploads/1/3/0/9/130969932/3391223.pdf
    • http://files.alliancemasonryrestoration.com/uploads/1/3/1/3/131384250/saxixaxokisudow_fufigelumirupol.pdf
    • http://files.amyopry.com/uploads/1/3/1/1/131164054/nixafu.pdf
    • http://files.alliancemasonryrestoration.com/uploads/1/3/1/3/131384250/saxixaxokisudow_fufig
    • https://cdn.shopify.com/s/files/1/0429/1795/3702/files/nijakasaza.pdf
    • https://cdn.shopify.com/s/files/1/0437/6307/3181/files/napav.pdf
    • https://cdn.shopify.com/s/files/1/0428/2833/3219/files/50387314271.pdf
    • https://cdn.shopify.com/s/files/1/0437/6556/3549/files/vofiwenibusatoj.pdf
    • https://cdn.shopify.com/s/files/1/0433/1690/4104/files/78856331295.pdf
    • https://cdn.shopify.com/s/files/1/0433/3735/1323/files/jowavedowebevub.pdf
    • https://cdn.shopify.com/s/files/1/0427/6341/9814/files/localhost_8181_home.pdf
    • https://cdn.shopify.com/s/files/1/0429/4639/6326/files/urolithiasis_journal.pdf
    • https://cdn.shopify.com/s/files/1/0429/7631/3503/files/warhammer_40000_necron_codex_ita.pdf
    • https://cdn.shopify.com/s/files/1/0431/3687/6695/files/types_of_reliability_with_examples.pdf
    • https://cdn.shopify.com/s/files/1/0430/4614/2114/files/gimubasuregitelatak.pdf
    • https://cdn.shopify.com/s/files/1/0431/0692/6741/files/34080094084.pdf
    • https://cdn.shopify.com/s/files/1/0429/9623/6447/files/14220057156.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_005_off00007b27.bin
ea4209396e4b20393f6eaebd1323554939af5916fcbcdb1bcee7387bbe0bbe9b		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x7B27 12084 bytes
font_00_sfnt_off00006a3e.bin
f0650b2caab572ff9afd1b068f2984ce0f694f576997b2478901fbaff08ab845		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6A3E 5004 bytes
font_02_sfnt_off00009d7e.bin
227fc109d4d14ef02d1dca3cc874194010f06ca440d4c9ddce8a880a3b42bfef		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9D7E 13824 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.