Malicious PDF — malware analysis report

Static analysis result for SHA-256 f67600812a51a3f7…

MALICIOUS

PDF

52.4 KB Created: 2020-08-31 16:23:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5d776c538ce19a023e63c02956709196 SHA-1: 188b765aec125e5151e65bc7d4ea348b570e9457 SHA-256: f67600812a51a3f742b2640fc7d21ff7c7b1d034d8f9c788e222c42994e20435
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a heuristic firing for PDF_MALICIOUS_REDIRECTOR_LINK, indicating it directs users to malicious infrastructure. The embedded URL https://ttraff.com/pify?keyword=cancionero+cristiano+pdf+2018 is the primary indicator of this malicious redirection. The file also exhibits characteristics of a PDF link farm, with numerous external links, though most resolve to benign content. The document body appears to be corrupted or obfuscated, but the presence of the malicious URL is sufficient to classify the attack pattern.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=cancionero+cristiano+pdf+2018
    • https://static.usrfiles.com/ugd/8cbfce_1537ee2870b449dbab64493fdff9e3b2.pdf
    • https://static.usrfiles.com/ugd/b8c837_acb377122f174942975dd9f44d648a55.pdf
    • https://static.usrfiles.com/ugd/b8c837_fb94574997d34b99a5d376fd9b6e0548.pdf
    • https://static.usrfiles.com/ugd/79e5df_35eb23fd28cf47b29a79b9b52342cac7.pdf
    • https://static.usrfiles.com/ugd/8de238_8bf9120df1b349a39ddb77f4eed0893f.pdf
    • https://static.usrfiles.com/ugd/b8c837_76426c93836a446db7be881da02757fc.pdf
    • https://static.usrfiles.com/ugd/e643da_9602d7ec893b41ffa0af2f3860fe411d.pdf
    • https://static.usrfiles.com/ugd/b8c837_a2321bc5fd6740268309fa9553565b9c.pdf
    • https://static.usrfiles.com/ugd/7c3584_bac2a60452e9447fb2dd1bcf5f969ea0.pdf
    • https://static.usrfiles.com/ugd/3b7182_1fd6bfce2cd74498b28c9fb845367826.pdf
    • https://cdn.shopify.com/s/files/1/0437/8850/1143/files/xumudanapivavizugikul.pdf
    • https://cdn.shopify.com/s/files/1/0435/9513/7187/files/dilations_worksheet_kuta.pdf
    • https://cdn.shopify.com/s/files/1/0429/8991/2218/files/87624195027.pdf
    • https://cdn.shopify.com/s/files/1/0435/3431/9776/files/torejifetamibuxevezed.pdf
    • https://cdn.shopify.com/s/files/1/0428/0087/3631/files/20861186101.pdf
    • https://cdn.shopify.com/s/files/1/0427/4041/6678/files/kemejutififevajopipun.pdf
    • https://cdn.shopify.com/s/files/1/0435/8271/8107/files/51741312054.pdf
    • https://cdn.shopify.com/s/files/1/0431/1960/7962/files/98994023209.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_006_off00009a4a.bin
ae87dd52b5c74c26da0139cde693b77d2c8b1211687ac8772e3251dc58378ba4		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x9A4A 17912 bytes
font_00_sfnt_off00006303.bin
915533a3a2b349aa5d6904e281d2352f06808f459e0440638c49d115214e8914		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6303 5448 bytes
font_01_sfnt_off0000759c.bin
c8eb652b4961681c0a9a0c9210dfbca3e4e20daab5204e23ddd0677d282d6064		 pdf-font-stream PDF embedded font (sfnt) at offset 0x759C 11116 bytes
font_03_sfnt_off0000b5ad.bin
05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB5AD 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.