Malicious PDF — malware analysis report

Static analysis result for SHA-256 fbd5038d62870fce…

MALICIOUS

PDF

65.2 KB Created: 2020-09-20 00:05:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fe0c6772b898f93b52dc96e2a9cae3ef SHA-1: c9ef45cf739af527163c77957573ab83bf376d13 SHA-256: fbd5038d62870fce95f76d033851ff90cdd73cd462a428bd006dd6024303b498
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.me/wix?keyword=multiplying+and+dividing+integers+word+problems+worksheet+with+answer+key+pdf'. This URL is presented within the document body, disguised as a worksheet. The PDF also contains a large number of embedded links, many pointing to Shopify domains, suggesting a link farm or SEO manipulation tactic. No scripts were extracted, but the presence of a malicious redirector URL is a strong indicator of a phishing or malware delivery attempt.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=multiplying+and+dividing+integers+word+problems+worksheet+with+answer+key+pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/99231100330.pdf
    • https://cdn.shopify.com/s/files/1/0451/3264/4505/files/algebra_y_trigonometria_addison_wesley.pdf
    • https://cdn.shopify.com/s/files/1/0484/2061/8392/files/rogers_county_jail_visitation.pdf
    • https://cdn.shopify.com/s/files/1/0438/0943/9906/files/basanudib.pdf
    • https://cdn.shopify.com/s/files/1/0435/5214/5560/files/how_to_open_ports_on_arris_router.pdf
    • https://cdn.shopify.com/s/files/1/0479/2906/5639/files/poc_bible_malayalam_online_purchase.pdf
    • https://cdn.shopify.com/s/files/1/0433/2394/9224/files/57456584659.pdf
    • https://cdn.shopify.com/s/files/1/0429/7441/2949/files/bozazola.pdf
    • https://cdn.shopify.com/s/files/1/0436/0696/6429/files/99921346265.pdf
    • https://cdn.shopify.com/s/files/1/0436/2344/8736/files/twisted_murderer_script.pdf
    • https://cdn.shopify.com/s/files/1/0432/4245/5195/files/sutimivafozubom.pdf
    • https://cdn.shopify.com/s/files/1/0433/7831/1326/files/python_send_sms.pdf
    • https://2b42319f-7991-4730-9168-ade214138d93.filesusr.com/ugd/76dd3d_0c5326daf613482ea637aa09b5624751.pdf?index=true
    • https://3d0868fd-61b5-4346-9245-4ee0e20dadc8.filesusr.com/ugd/cc089a_0e4e2ee06ecd46168b165e3e0c25e746.pdf?index=true
    • https://c06551b0-d986-4164-b118-d49296208ae9.filesusr.com/ugd/64db51_1e7862672dd84de2a1271e4c28ca8e43.pdf?index=true
    • https://3d99c1af-4f30-4428-9cb1-47977beb7526.filesusr.com/ugd/0d018b_5622b12b958441918a9de1756f78c0cf.pdf?index=true
    • https://d2989e82-ec1d-4794-91ff-ee80e2521b54.filesusr.com/ugd/a58502_3972fff7ad1f4f4b998791243bd81978.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000a520.bin
85b692c1c636aed9ab1240d2a7361179fdd6c0849396a06064984f922e967b4f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA520 2828 bytes
font_01_sfnt_off0000af1a.bin
a8224d495c7e6714879cddcd326094308c16c7fe02bda208f5aa9053705989bf		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAF1A 5800 bytes
font_02_sfnt_off0000c2c7.bin
99632bac1329dc1cc90407550d061ab30d3362aa7c8599449d73ee522b072db3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC2C7 10116 bytes
font_03_sfnt_off0000e552.bin
05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE552 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.