Malicious PDF — malware analysis report

Static analysis result for SHA-256 fbb8e0cf37d31909…

MALICIOUS

PDF

37.3 KB Created: 2020-08-24 12:40:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 67d8c63a7e68b8147cdaa2b8a7a6d986 SHA-1: 31d2a43f70bc2069f83ef752afb9851b97ab22e4 SHA-256: fbb8e0cf37d3190995281564962e24e1c7e21ccb9b38970e83c85ecab2ac9e77
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains numerous embedded links, with a critical heuristic firing for a malicious redirector at 'https://ttraff.com/pify?keyword=printable+annual+physical+exam+form+bsa'. Another critical heuristic indicates a PDF link farm, suggesting an attempt to distribute or SEO-poison related content. The document body, though heavily obfuscated, contains references to forms and URLs, reinforcing the lure. No scripts were extracted from this sample.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=printable+annual+physical+exam+form+bsa
    • http://files.candlesinthedarkness.com/uploads/1/3/0/7/130775025/gonavaviridovepevige.pdf
    • https://cdn.shopify.com/s/files/1/0431/9117/3278/files/flight_simulator_x_ocean_of_games.pdf
    • https://cdn.shopify.com/s/files/1/0428/9226/3583/files/pofaxumurumanil.pdf
    • https://cdn.shopify.com/s/files/1/0427/4018/7303/files/danipexojozavup.pdf
    • https://cdn.shopify.com/s/files/1/0435/5109/6991/files/writing_and_evaluating_algebraic_expressions_worksheet.pdf
    • https://cdn.shopify.com/s/files/1/0435/5781/4431/files/adverbs_of_frequency_speaking.pdf
    • https://cdn.shopify.com/s/files/1/0432/9160/7190/files/tuzomilefutazepetumejuwe.pdf
    • https://cdn.shopify.com/s/files/1/0449/5589/3928/files/deck_the_halls_with_boughs_of_holly.pdf
    • https://cdn.shopify.com/s/files/1/0431/6269/7894/files/73573359078.pdf
    • https://cdn.shopify.com/s/files/1/0427/8072/1311/files/toefl_reading.pdf
    • https://cdn.shopify.com/s/files/1/0433/9433/4870/files/76081070451.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000053bf.bin
2c868192e61316a36f38b6073892316750739afe8edfedb5b74cf8d58cc9405c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x53BF 5568 bytes
font_01_sfnt_off00006682.bin
798d4568c5e3398d88d5c795d07f927f9c0625b69ecd42b1a64bd86a4b756a9a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6682 9872 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.