Malicious PDF — malware analysis report

Static analysis result for SHA-256 f34f79c427cdc23a…

MALICIOUS

PDF

60.2 KB Created: 2020-08-06 16:54:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8b13f97fa1d54fcbd9b9ac55bf2c12e1 SHA-1: d3d17bc3bb5665834d41daeb9142746da674b5b0 SHA-256: f34f79c427cdc23a495a49ef580af029bf2d4802e1f4f18c303348cbfdec7097
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains numerous external links, with a critical heuristic firing indicating a link farm and a redirector to a known malicious domain. The primary malicious URL identified is 'https://ttraff.com/pify?keyword=skewness+statistics+pdf'. While the document body contains garbled text and embedded URLs, the heuristic firings strongly suggest the PDF's purpose is to lure users to malicious sites. No scripts were extracted, limiting further analysis of the payload.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=skewness+statistics+pdf
    • http://files.eq-apparel.co.uk/uploads/1/3/1/4/131454286/terex-xemutojaniwax.pdf
    • http://files.ciaocristina.com/uploads/1/3/1/3/131379183/45ba155.pdf
    • http://wipux.bonescanoeandcampground.com/uploads/1/3/0/8/130874276/zikobudejitidirojom.pdf
    • http://files.bellaembellishments.com/uploads/1/3/1/3/131381078/898ef56537.pdf
    • https://cdn.shopify.com/s/files/1/0449/8666/3070/files/mary_balogh_livros.pdf
    • https://cdn.shopify.com/s/files/1/0436/9956/8795/files/53589039119.pdf
    • https://cdn.shopify.com/s/files/1/0434/3716/2646/files/social_psychology_10th_edition_kassin.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/zeranosorijajigafa.pdf
    • https://cdn.shopify.com/s/files/1/0436/1748/4957/files/accelerated_testing_statistical_models_test_plans_and_data_analysis.pdf
    • https://cdn.shopify.com/s/files/1/0430/8130/2167/files/watch_spartcus_online.pdf
    • https://cdn.shopify.com/s/files/1/0434/2186/0007/files/dayz_mod_launcher.pdf
    • https://cdn.shopify.com/s/files/1/0427/8134/3900/files/magedigitosemaro.pdf
    • https://cdn.shopify.com/s/files/1/0431/0004/5469/files/87621213224.pdf
    • https://cdn.shopify.com/s/files/1/0432/6470/4662/files/neural_network_example_problem.pdf
    • https://cdn.shopify.com/s/files/1/0432/8397/2256/files/97216722987.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008a7a.bin
e5ad15eab49f9be25e3c67a167da28fe6fed7b7aef5ef5d6195b51fc5177f28f
pdf-font-stream PDF embedded font (sfnt) at offset 0x8A7A 5280 bytes
font_01_sfnt_off00009ca3.bin
7812be8995f5f44553da0cbf93393188dc9a99555fff571ed22ed2e68f1604db
pdf-font-stream PDF embedded font (sfnt) at offset 0x9CA3 16100 bytes
font_02_sfnt_off0000cf42.bin
28c03bcf599e3456f71dbda7a9940e8017c4b7a6e15fdbd9d4eba8bfcd1a11e4
pdf-font-stream PDF embedded font (sfnt) at offset 0xCF42 16064 bytes