Malicious PDF — malware analysis report

Static analysis result for SHA-256 fecb552547530e44…

MALICIOUS

PDF

44.5 KB Created: 2020-08-10 14:16:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 179bfe5205a3ebc38677a8dd165c11c1 SHA-1: 5025dfc6c51f1cb87c6af826d6d5d245c3c81e69 SHA-256: fecb552547530e44394d22e55c8a522b48380c1a5f958810230526c73461c72b
182 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a lure promising free access to 'CCNA Cyber Ops PDF' which, upon clicking, redirects through a malicious link farm. The primary malicious URL identified is ttraff.cc, which is known to host redirectors. The document body, though partially corrupted, contains the malicious URL and other links that appear to be part of a link farm designed to obscure the ultimate destination.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Recovery secret / private key request critical SE_SECRET_RECOVERY_LURE
    Document requests recovery phrases, private keys, backup codes, or saved passwords. Requests for these secrets in a document are high-risk.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=ccna+cyber+ops+pdf+free
    • http://files.hacd.org/uploads/1/3/1/4/131437378/2847984.pdf
    • http://files.lyricallyjustified.co.uk/uploads/1/3/0/7/130775953/wikibuxo_jumewow.pdf
    • http://xonowovus.calmcradle.com/uploads/1/3/1/6/131636725/03e2284.pdf
    • http://files.recollectiveway.org/uploads/1/3/1/4/131408017/f723b92a39858d2.pdf
    • http://files.travelwithsaranewbury.com/uploads/1/3/1/3/131380138/2502475.pdf
    • https://cdn.shopify.com/s/files/1/0439/2982/9544/files/curriculum_vitae_formato_para_rellenar_gratis.pdf
    • https://cdn.shopify.com/s/files/1/0436/2331/7662/files/wajalidavavel.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/sazofafusogowo.pdf
    • https://cdn.shopify.com/s/files/1/0433/5121/2200/files/romokononezolivelo.pdf
    • https://cdn.shopify.com/s/files/1/0428/5900/4070/files/blades_in_the_dark_rulebook.pdf
    • https://cdn.shopify.com/s/files/1/0435/0623/7604/files/miresibejosolefowowuku.pdf
    • https://cdn.shopify.com/s/files/1/0428/6801/5260/files/53747218625.pdf
    • https://cdn.shopify.com/s/files/1/0437/9164/6880/files/10652652307.pdf
    • https://cdn.shopify.com/s/files/1/0434/4617/3852/files/87724050024.pdf
    • https://cdn.shopify.com/s/files/1/0431/9186/1412/files/45965739791.pdf
    • https://cdn.shopify.com/s/files/1/0432/3957/1616/files/etiology_of_type_1_diabetes_mellitus.pdf
    • https://cdn.shopify.com/s/files/1/0432/0801/6027/files/12423229241.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006e35.bin
540776816a961198428a084893dc4d702e5bd3e08081fc20a28ead30590a7a57
pdf-font-stream PDF embedded font (sfnt) at offset 0x6E35 5264 bytes
font_01_sfnt_off0000801a.bin
e10a0cea171b91b2d39afb66111e21aa057c8cfaad80ef71f7f52a2fde9e44e5
pdf-font-stream PDF embedded font (sfnt) at offset 0x801A 11152 bytes