Malicious PDF — malware analysis report

Static analysis result for SHA-256 ff2c51c0222bd8b7…

MALICIOUS

PDF

41.0 KB Created: 2020-08-11 20:27:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9604cd68f43c99c7f0e6f573f548d00a SHA-1: 7eeedeb3a6d993bb4bb0d5f6db3b656c4d29484c SHA-256: ff2c51c0222bd8b784719381c0d7f6abb3b87742fa886db7909af0b9baa93843
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains numerous embedded links, a common technique for SEO poisoning and redirecting users to malicious sites. The primary malicious redirector link, https://ttraff.cc/pify?keyword=shafins+spoken+english+book+pdf+free+download, is directly associated with the lure of a free English book PDF. The file also exhibits characteristics of a link farm, with a large number of external PDF links, many of which point to benign Shopify domains but are likely used to inflate search engine rankings. The presence of these links and the deceptive content strongly suggest an attempt to drive traffic to potentially harmful destinations.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=shafins+spoken+english+book+pdf+free+download
    • http://dimulo.westminsterbbic.org/uploads/1/3/1/1/131164250/wexesa.pdf
    • http://files.rainbowjewelryshop.com/uploads/1/3/1/3/131383318/50e36b15.pdf
    • http://files.katdeiner.com/uploads/1/3/1/3/131382387/e03037.pdf
    • http://files.cellphonerepairmissionviejo.com/uploads/1/3/1/6/131606815/ce7d49.pdf
    • http://files.wild-obsession.co.za/uploads/1/3/1/4/131406108/7906238.pdf
    • https://cdn.shopify.com/s/files/1/0435/5099/8679/files/acordes_de_canciones_guitarra.pdf
    • https://cdn.shopify.com/s/files/1/0429/8850/3203/files/1325870427.pdf
    • https://cdn.shopify.com/s/files/1/0436/8393/8457/files/birmingham_university_campus_map.pdf
    • https://cdn.shopify.com/s/files/1/0434/5423/4785/files/48248265979.pdf
    • https://cdn.shopify.com/s/files/1/0427/5752/1574/files/2267714472.pdf
    • https://cdn.shopify.com/s/files/1/0430/6547/5226/files/43211063437.pdf
    • https://cdn.shopify.com/s/files/1/0432/7201/1941/files/96029518618.pdf
    • https://cdn.shopify.com/s/files/1/0431/9641/6160/files/tobowuvejugisujunowuguwi.pdf
    • https://cdn.shopify.com/s/files/1/0429/9636/7511/files/weather_mcalester_ok.pdf
    • https://cdn.shopify.com/s/files/1/0439/6358/0574/files/3288279741.pdf
    • https://cdn.shopify.com/s/files/1/0437/4629/5959/files/dafesagexulobufogukemipu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006160.bin
4b12264b871f74d12b06384b1652247a779b17e78d5f8e41e52350bfe021fe7c
pdf-font-stream PDF embedded font (sfnt) at offset 0x6160 5704 bytes
font_01_sfnt_off000074c5.bin
5546dd7157b37c0dc97b3eec497a685244012681cfaf2329c83547961cec609b
pdf-font-stream PDF embedded font (sfnt) at offset 0x74C5 9948 bytes