Malicious PDF — malware analysis report

Static analysis result for SHA-256 1d3334c74fdcec0c…

MALICIOUS

PDF

49.3 KB Created: 2020-08-08 04:14:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 922dd4cf0e661ca6a35a58734ce6d2de SHA-1: ebbdcf2a7f7ea558116dfc1497538a7f15775877 SHA-256: 1d3334c74fdcec0cd8e38ab0beb4c368bff2f1302c9902bbe9939ea04d00d427
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.ru/pify?keyword=bcpl+language+pdf'. Additionally, another critical heuristic indicates a PDF link farm with 17 external PDF links, many hosted on shopify.com. The document body, though heavily obfuscated, contains references to these URLs. The primary intent appears to be directing users to malicious infrastructure through a deceptive link farm.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=bcpl+language+pdf
    • http://files.nautydoggundogkennels.com/uploads/1/3/0/7/130775734/52b34c.pdf
    • http://files.npanglers.com/uploads/1/3/0/8/130814043/pomikelojon.pdf
    • http://files.skinlosophy.shop/uploads/1/3/0/8/130874278/7b9732ee3.pdf
    • https://cdn.shopify.com/s/files/1/0434/5361/2199/files/jovubiwupij.pdf
    • https://cdn.shopify.com/s/files/1/0431/0423/9770/files/zuxelatojerifebil.pdf
    • https://cdn.shopify.com/s/files/1/0440/1948/2774/files/71521215290.pdf
    • https://cdn.shopify.com/s/files/1/0429/1949/3785/files/37102574828.pdf
    • https://cdn.shopify.com/s/files/1/0436/3337/7440/files/noruxuxefuwi.pdf
    • https://cdn.shopify.com/s/files/1/0433/3030/6203/files/suxekojakolojapiri.pdf
    • https://cdn.shopify.com/s/files/1/0434/7589/4422/files/26852344258.pdf
    • https://cdn.shopify.com/s/files/1/0436/9947/0486/files/lugusotigipowetigizeluw.pdf
    • https://cdn.shopify.com/s/files/1/0432/5857/7046/files/71252674233.pdf
    • https://cdn.shopify.com/s/files/1/0433/8178/4726/files/chromosomal_disorders_list.pdf
    • https://cdn.shopify.com/s/files/1/0438/6550/5952/files/99426609512.pdf
    • https://cdn.shopify.com/s/files/1/0429/8794/6133/files/wokam.pdf
    • https://cdn.shopify.com/s/files/1/0434/4456/8220/files/vupuwubafobokuma.pdf
    • https://cdn.shopify.com/s/files/1/0431/4205/4048/files/wemogizepabifafena.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000071c0.bin
565e9c4c3158bc87fc264fe9c7e90e77b8d60ae5bfdb59235c0a458096ac9da2
pdf-font-stream PDF embedded font (sfnt) at offset 0x71C0 3940 bytes
font_01_sfnt_off00007fd7.bin
84df2d0e4bb3e5f0d20b334093849ad3e0a33e86a16a2270161d0ff68139598c
pdf-font-stream PDF embedded font (sfnt) at offset 0x7FD7 5096 bytes
font_02_sfnt_off00009148.bin
78c1427f82fa9bbe89ab3efb7ee3776cee6e99e5f13105805330c9c7f3cd51fd
pdf-font-stream PDF embedded font (sfnt) at offset 0x9148 11736 bytes