Malicious PDF — malware analysis report

Static analysis result for SHA-256 ed97c1f92a067190…

MALICIOUS

PDF

41.8 KB Created: 2020-08-23 04:33:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8332babbb184081f66aa0e341d3a18c6 SHA-1: 430ec3a7159e2c44539a1a1bbc1c77bc6c7ee675 SHA-256: ed97c1f92a0671906a7a1781b07d8433c1b283ef34190434b2b24f44fbcd9207
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a mass external link farm, with one critical heuristic identifying a link to a known malicious redirector. The document body, though partially corrupted, contains text related to online games and a URL that appears to be part of the malicious redirection chain. The primary malicious URL is https://ttraff.com/pify?keyword=play+scrabble+online+for+free+without+ing, which likely leads to further malicious content.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=play+scrabble+online+for+free+without+ing
    • http://lotukod.sermujersma.com/uploads/1/3/2/6/132682646/6465183.pdf
    • http://files.kohoboutiquestl.com/uploads/1/3/1/4/131484603/tafowe-nedupexadaxewir-kaxoxobigafe.pdf
    • http://files.islandschoolhistory.com/uploads/1/3/0/7/130739892/fapezekoto-sedepiketet-rirod-gimufimolajazi.pdf
    • https://cdn.shopify.com/s/files/1/0440/0028/0734/files/eu4_brandenburg_ideas_guide.pdf
    • https://cdn.shopify.com/s/files/1/0435/8491/3563/files/99352944627.pdf
    • https://cdn.shopify.com/s/files/1/0432/6552/3870/files/91889356998.pdf
    • https://cdn.shopify.com/s/files/1/0439/9572/5982/files/xalagerotusop.pdf
    • https://cdn.shopify.com/s/files/1/0432/0726/2367/files/512046370.pdf
    • https://cdn.shopify.com/s/files/1/0434/7668/0869/files/2054898543.pdf
    • https://cdn.shopify.com/s/files/1/0436/7400/9753/files/advantages_and_disadvantages_of_venture_capital_financing.pdf
    • https://cdn.shopify.com/s/files/1/0436/2724/9826/files/disneyworld_magic_kingdom_map.pdf
    • https://cdn.shopify.com/s/files/1/0446/6124/4067/files/quimica_inorganica_catherine_housecroft_download_portugus.pdf
    • https://cdn.shopify.com/s/files/1/0433/6762/8950/files/25825288218.pdf
    • https://cdn.shopify.com/s/files/1/0427/9386/1279/files/65691060046.pdf
    • https://cdn.shopify.com/s/files/1/0429/0304/4263/files/57980654552.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006547.bin
abbc23935dc3d70ffd13f8897c2754a859e0cfab36b1183cb793dc80deb5ada2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6547 5476 bytes
font_01_sfnt_off000077f5.bin
f77f22d86ffa9be0921409dc703e648a152da9346c60a49a1a0015f5bcbfe34a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x77F5 9968 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.