Malicious PDF — malware analysis report

Static analysis result for SHA-256 25db5d6ca5e8242d…

MALICIOUS

PDF

49.8 KB Created: 2020-08-11 09:12:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 69ab2caa999ea61f9c4532da84a98c1a SHA-1: 4566cb72f308acbd61355a5134333e24788f9e15 SHA-256: 25db5d6ca5e8242dea8933023c638888554b77b56d35f47e6cc29e8908768cd1
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

This PDF document acts as a link farm, directing users to a malicious redirector at 'ttraff.ru' disguised as a user manual search result. The document contains numerous embedded links, many pointing to Shopify domains, but the primary malicious intent is facilitated by the 'ttraff.ru' URL. The PDF structure and embedded links are consistent with SEO poisoning techniques used to distribute malware.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wb?keyword=maytag%20gemini%20user%20manual
    • http://files.steveridestheworld.com/uploads/1/3/1/3/131383325/sudexomix-bebozuzujiju-gatawenuj.pdf
    • http://files.misshaleyart.com/uploads/1/3/2/3/132302859/kibipolafodiri_kidugemojufu_bovibop_tetibojuge.pdf
    • http://dofoxusav.alecworley.com/uploads/1/3/1/3/131398140/3100225.pdf
    • http://xapureta.sietinternational.org/uploads/1/3/1/4/131407089/2956461.pdf
    • http://files.springbrookaerospace.com/uploads/1/3/1/3/131380337/5741275.pdf
    • https://cdn.shopify.com/s/files/1/0433/7483/7925/files/wabob.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/26384136461.pdf
    • https://cdn.shopify.com/s/files/1/0433/7201/9877/files/lominop.pdf
    • https://cdn.shopify.com/s/files/1/0431/3179/7668/files/algorithme_de_tri_et_de_recherche.pdf
    • https://cdn.shopify.com/s/files/1/0431/0096/2977/files/tinufosediluduxajuxij.pdf
    • https://cdn.shopify.com/s/files/1/0431/8262/0834/files/35584999648.pdf
    • https://cdn.shopify.com/s/files/1/0434/6049/3474/files/59997903117.pdf
    • https://cdn.shopify.com/s/files/1/0435/7206/8520/files/brahmanda_puranam_telugu.pdf
    • https://cdn.shopify.com/s/files/1/0434/4214/3397/files/tujovixogukafupero.pdf
    • https://cdn.shopify.com/s/files/1/0430/5489/1161/files/the_x_files_theme_song.pdf
    • https://cdn.shopify.com/s/files/1/0432/6345/9496/files/66646251365.pdf
    • https://cdn.shopify.com/s/files/1/0431/6217/3602/files/15645937797.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006cc9.bin
457d19c74f7abae7fb5b108ae64cfad72cd85a82f30460ceca0c284ba9431fb8
pdf-font-stream PDF embedded font (sfnt) at offset 0x6CC9 5112 bytes
font_01_sfnt_off00007e1e.bin
114a1fce03271a8b40f00e8b16170acea32f0a85fbf4bbfd6fe7daa95504d857
pdf-font-stream PDF embedded font (sfnt) at offset 0x7E1E 11504 bytes
font_02_sfnt_off0000a4f5.bin
ffad8dbc339acf9f6a7b1c1b901d719cd2bc945b1b13bfb8173beab322595c47
pdf-font-stream PDF embedded font (sfnt) at offset 0xA4F5 16064 bytes