Malicious PDF — malware analysis report

Static analysis result for SHA-256 28a69448fa41cf6b…

MALICIOUS

PDF

51.3 KB Created: 2020-08-03 14:48:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6d1cdf19108c74c0906f3c2dd3e53e67 SHA-1: 2845e2f59345635c022a41aa7215662880b98d54 SHA-256: 28a69448fa41cf6b23833b0baa4060c5eaf66f308d49a38a541fbc3a0f1aaf04
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a significant number of embedded links, with a critical heuristic firing for PDF_SEO_LINK_FARM indicating a mass external PDF link farm. One of these links, 'https://ttraff.ru/pify?keyword=tv+broadcasting+technology+pdf', is flagged as a malicious redirector. The document body is heavily obfuscated but contains references to the redirector URL. The primary purpose appears to be SEO manipulation or redirecting users to malicious content.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=tv+broadcasting+technology+pdf
    • http://files.jestersmvp.com/uploads/1/3/1/8/131871614/xevokoreda.pdf
    • http://files.markromangbooks.com/uploads/1/3/1/4/131453990/0d3a6c582e8a9.pdf
    • http://files.mylavishlylathered.com/uploads/1/3/1/8/131857334/4554032.pdf
    • http://files.barnes1ststepft.com/uploads/1/3/0/7/130776239/942178a675e13e.pdf
    • https://cdn.shopify.com/s/files/1/0430/6314/8706/files/kotiziderabuva.pdf
    • https://cdn.shopify.com/s/files/1/0432/1312/7844/files/89643531821.pdf
    • https://cdn.shopify.com/s/files/1/0438/3725/9938/files/fisobuwimanar.pdf
    • https://cdn.shopify.com/s/files/1/0428/4982/9023/files/14695796724.pdf
    • https://cdn.shopify.com/s/files/1/0430/9411/4465/files/72929839410.pdf
    • https://cdn.shopify.com/s/files/1/0434/5017/1554/files/98404954972.pdf
    • https://cdn.shopify.com/s/files/1/0433/2496/5019/files/essential_calculus_2nd_edition_solution_manual.pdf
    • https://cdn.shopify.com/s/files/1/0432/9373/7110/files/laxuraruled.pdf
    • https://cdn.shopify.com/s/files/1/0432/9334/3899/files/53293107781.pdf
    • https://cdn.shopify.com/s/files/1/0431/6767/8618/files/nulufetijomekonijimik.pdf
    • https://cdn.shopify.com/s/files/1/0431/6413/9674/files/91822552431.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008abf.bin
f346d3611e29213b26e662188207c53d345ba8b62bf5b47a7d9a1ae548d4fd19		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8ABF 5668 bytes
font_01_sfnt_off00009e0b.bin
00633edbbdfa5b6fcae5cd9b5de9840ef6ef205da9fcf0fbdf4ee12119ba2e32		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9E0B 10032 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.