Malicious PDF — malware analysis report

Static analysis result for SHA-256 1a5f256625db5ff1…

MALICIOUS

PDF

54.0 KB Created: 2020-08-02 11:18:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 486a0fc62ce0351e490c654af6fede02 SHA-1: e379d6c216bb36f2a96adb9f68704fed572417cd SHA-256: 1a5f256625db5ff1ec853536c9bc96f147829e7d742864a7cc60e19a2d7fa8db
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.ru/pify?keyword=ppap+manual+pdf'. This URL is presented within the document body, suggesting a social engineering lure. The PDF also exhibits characteristics of a link farm, with numerous embedded URLs, many hosted on cdn.shopify.com, likely for SEO manipulation or to obscure the true malicious destination. No scripts were extracted, and the document body was heavily obfuscated, limiting further analysis of the payload.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=ppap+manual+pdf
    • http://files.clareslaneycounselling.com/uploads/1/3/0/8/130874257/8224303.pdf
    • http://files.aaaction.org/uploads/1/3/2/6/132682974/bcf9a.pdf
    • http://files.margenachristian.com/uploads/1/3/0/7/130775639/digomavowas.pdf
    • https://cdn.shopify.com/s/files/1/0428/6359/1583/files/square_root_python.pdf
    • https://cdn.shopify.com/s/files/1/0433/9453/1493/files/rupex.pdf
    • https://cdn.shopify.com/s/files/1/0428/3927/7734/files/96112111287.pdf
    • https://cdn.shopify.com/s/files/1/0435/5584/8355/files/76708687432.pdf
    • https://cdn.shopify.com/s/files/1/0428/8518/5702/files/pekigenebo.pdf
    • https://cdn.shopify.com/s/files/1/0429/9508/9559/files/pokemon_mmorpg_3d.pdf
    • https://cdn.shopify.com/s/files/1/0429/2503/1590/files/fepur.pdf
    • https://cdn.shopify.com/s/files/1/0432/5320/3102/files/17735627074.pdf
    • https://cdn.shopify.com/s/files/1/0437/1405/2247/files/hp_officejet_6500_e710n-_z.pdf
    • https://cdn.shopify.com/s/files/1/0431/3622/1351/files/gofijomuruvozinolewuwejaj.pdf
    • https://cdn.shopify.com/s/files/1/0433/1926/3397/files/zobenimesaled.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000838a.bin
4fe1f96ba8db5cf35ca47cddaf067669eaebb9c038fc61eabfa1f5836d0fc525		 pdf-font-stream PDF embedded font (sfnt) at offset 0x838A 1768 bytes
font_01_sfnt_off00008bff.bin
9117bbf316fc2ea3b6e817c786b4239c6e639bc9bbc85041159577d557ec1aa5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8BFF 2864 bytes
font_02_sfnt_off0000962f.bin
a9a41c91ef36f3ee61e348ceeef5f20e9a52a26a142a8965eab91f00e70bd7b3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x962F 4916 bytes
font_03_sfnt_off0000a6dd.bin
6ca2198a8a9dfc3842204dd3d6b2cac79bb22d4b9a80908c12dfdbfdb77fd39a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA6DD 10480 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.