Malicious PDF — malware analysis report

Static analysis result for SHA-256 e67b9ecbde6d5410…

MALICIOUS

PDF

40.9 KB Created: 2020-08-30 18:40:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 67862d407fcfb16f706fd326027f994a SHA-1: 6ae9739126b00dcff8b88ecc72672c0c9759259c SHA-256: e67b9ecbde6d5410f68c64817adaef212e4a828d89903e149b8f01c35f83f3f2
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains numerous embedded links, a common tactic for SEO poisoning and redirecting users to malicious sites. One critical heuristic identified a link to a known malicious redirector infrastructure at 'ttraff.com'. The document body, though heavily obfuscated, contains text related to 'Gold's gym competitor series' and the URL 'https://ttraff.com/wix?keyword=gold%2527s+gym+competitor+series', suggesting a lure to a phishing or malware distribution site.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=gold%2527s+gym+competitor+series
    • https://cdn.shopify.com/s/files/1/0436/9190/1081/files/wipunetutajokaxivema.pdf
    • https://cdn.shopify.com/s/files/1/0433/8502/8758/files/heavy_is_dead.pdf
    • https://cdn.shopify.com/s/files/1/0431/1826/4469/files/26117170316.pdf
    • https://cdn.shopify.com/s/files/1/0435/2652/0986/files/xorusizowave.pdf
    • https://cdn.shopify.com/s/files/1/0434/5459/5224/files/nugiw.pdf
    • https://static.usrfiles.com/ugd/b8c837_af500229a2e44a8b9d5c62dcc5ab6749.pdf
    • https://static.usrfiles.com/ugd/b8c837_16b52d1e7e444b0396e282047c1fca6e.pdf
    • https://static.usrfiles.com/ugd/b8c837_947bb5f389fb4debabc2e21b2e1a5749.pdf
    • https://static.usrfiles.com/ugd/2f8cea_e06a5970d6594169abd01c588695fc9a.pdf
    • https://static.usrfiles.com/ugd/e643da_2b71590753394a209203821fe4f2e1d2.pdf
    • https://cdn.shopify.com/s/files/1/0437/8053/8526/files/femoxege.pdf
    • https://cdn.shopify.com/s/files/1/0431/9212/3553/files/que_es_un_trauma_psicologico.pdf
    • https://cdn.shopify.com/s/files/1/0437/6553/0785/files/dnd_5e_oathbreaker.pdf
    • https://cdn.shopify.com/s/files/1/0432/0002/0635/files/wexewutogixuxezataga.pdf
    • https://cdn.shopify.com/s/files/1/0427/8799/5807/files/givefix.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005f4f.bin
74cca2432ef1a968c6bfec3f25d3cb3a06703cbdba38bb4ac9926bf1fc7d4c27		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5F4F 5352 bytes
font_01_sfnt_off00007182.bin
dfa3d58f8bfc01dbeb075f93da0011519e9f81a166bd238190b15f4097e85612		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7182 10540 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.