Malicious PDF — malware analysis report

Static analysis result for SHA-256 f7aa8520cdee6e1e…

MALICIOUS

PDF

38.5 KB Created: 2020-08-10 06:11:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3aa99f283b73b9842d10f27f67d59319 SHA-1: a569fda6d3dc9218056f44bcc9f0fa6ba786ea40 SHA-256: f7aa8520cdee6e1e784b7d6a6fccef4e362cbd0af69118b12bec8bc6ca4f064f
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to ttraff.com. The document body also contains this URL, suggesting it's the primary lure. The file also exhibits characteristics of a link farm, with numerous embedded URLs, many hosted on cdn.shopify.com, likely to improve search engine ranking for the malicious content. No scripts were extracted, but the presence of the malicious URL is sufficient evidence for the attack pattern.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=navneet+dictionary+english+to+gujarati+pdf
    • http://files.mdsmeats.co.uk/uploads/1/3/0/7/130776149/sujekawaburokuzig.pdf
    • http://files.flowphoto-tahoe.com/uploads/1/3/2/3/132303238/vorejukimomup-nozigo-kavewes-poletusub.pdf
    • http://files.arteristrutturare.com/uploads/1/3/0/9/130969705/kifatodojibuvuji.pdf
    • http://files.taragraceericson.com/uploads/1/3/1/6/131606490/9294033.pdf
    • http://files.archvizblender.com/uploads/1/3/2/3/132303226/3e1116b.pdf
    • https://cdn.shopify.com/s/files/1/0435/5335/7985/files/install_gpg_mac.pdf
    • https://cdn.shopify.com/s/files/1/0437/2103/1832/files/80425978252.pdf
    • https://cdn.shopify.com/s/files/1/0429/6795/7660/files/wubupalawadodo.pdf
    • https://cdn.shopify.com/s/files/1/0432/8466/0380/files/43561993858.pdf
    • https://cdn.shopify.com/s/files/1/0434/5911/7206/files/bleach_hd_mugen.pdf
    • https://cdn.shopify.com/s/files/1/0431/4077/6090/files/bifezazugaf.pdf
    • https://cdn.shopify.com/s/files/1/0431/5788/0996/files/ielts_speaking.pdf
    • https://cdn.shopify.com/s/files/1/0433/1126/7990/files/basant_maheshwari.pdf
    • https://cdn.shopify.com/s/files/1/0430/8631/5671/files/kedudivosi.pdf
    • https://cdn.shopify.com/s/files/1/0432/0421/4942/files/54939278001.pdf
    • https://cdn.shopify.com/s/files/1/0434/4745/1798/files/printable_nafta_form.pdf
    • https://cdn.shopify.com/s/files/1/0431/7354/4093/files/gobinaralujobipig.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004875.bin
1c93c7fe7ef678d8e603a1388555312ef4ea880f084103381fea846b1cf544eb
pdf-font-stream PDF embedded font (sfnt) at offset 0x4875 5624 bytes
font_01_sfnt_off00005baf.bin
41bca3bb10ec3b31d73cdd030358e967ab41786918813e47a126eda0791664fe
pdf-font-stream PDF embedded font (sfnt) at offset 0x5BAF 4796 bytes
font_02_sfnt_off00006afc.bin
01c6632cf2c7e4c52c723a750c39d22a04ae5a07d4a3ff660b19bab44b2a62f6
pdf-font-stream PDF embedded font (sfnt) at offset 0x6AFC 9812 bytes