Malicious PDF — malware analysis report

Static analysis result for SHA-256 33a812dcfc4a1709…

MALICIOUS

PDF

42.5 KB Created: 2020-08-26 12:31:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 11abbab12a46703cdae8416f79673977 SHA-1: e9f5e764ebe6b00bc7742ca5118d7776a4c2bdd4 SHA-256: 33a812dcfc4a1709b51a2436b25ab1c7c45e371834a80eabcae22e7e9ab05782
260 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious Link T1566.002 Spearphishing Attachment

The PDF file contains multiple heuristics indicating malicious intent, including direct payload links and a link farm designed for SEO manipulation. The document body, though heavily obfuscated, contains a URL that appears to be a lure for a game download. This, combined with the 'SE_PASSWORD_ARCHIVE_LURE' heuristic, suggests the PDF is designed to trick users into downloading a password-protected archive, likely containing malware. The primary malicious URL identified is ttraff.ru.

Heuristics 6

  • PDF link points directly to executable/archive payload critical PDF_DIRECT_PAYLOAD_LINK
    PDF contains a clickable HTTP(S) URI whose path ends in an executable, script, shortcut, disk image, or archive extension. Documents can legitimately link to installers, so this is a high-risk delivery indicator rather than a standalone exploit fingerprint.
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Clickable PDF combines external action with parser-evasion structure high PDF_ACTION_PARSER_EVASION
    PDF has an external clickable URI together with object graph or xref structures that make parsers disagree, such as divergent duplicate objects, parser divergence, or xref offset mismatch. That combination is stronger than a plain link: the document is both an outward-action carrier and a parser-confusion/evasion sample.
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=gta+san+andreas+extreme+edition+2011+www.pcgamespunch.com
    • http://files.theartsparkle.com/uploads/1/3/1/6/131606118/zubafiteru-xifogi-takupug-vawufuvabux.pdf
    • http://sagew.torgbrewery.com/uploads/1/3/1/4/131437792/gozuwobutitekigo.pdf
    • http://fikexil.imadsz.org/uploads/1/3/0/8/130813612/samad-vezajutib-luzilefixamag.pdf
    • http://nelur.mccoymultimediallc.com/uploads/1/3/1/3/131398504/6f944bb.pdf
    • https://cdn.shopify.com/s/files/1/0432/8656/0936/files/raribogofelufipi.pdf
    • https://cdn.shopify.com/s/files/1/0430/8205/5829/files/wefif.pdf
    • https://cdn.shopify.com/s/files/1/0438/1822/1728/files/munogozubu.pdf
    • https://cdn.shopify.com/s/files/1/0435/5548/7905/files/basic_and_bedside_electrocardiography_free.pdf
    • https://cdn.shopify.com/s/files/1/0430/7854/9665/files/justice_league_dark_imdb_parents_guide.pdf
    • https://cdn.shopify.com/s/files/1/0462/6504/1047/files/larujomomufodit.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/zilifevuzumojewod.pdf
    • https://cdn.shopify.com/s/files/1/0431/7301/9797/files/magellan_rx_medicaid_trend_report.pdf
    • https://cdn.shopify.com/s/files/1/0431/4251/2791/files/zamasalufapovobajipatuzox.pdf
    • https://cdn.shopify.com/s/files/1/0434/3129/7185/files/92241733789.pdf
    • https://cdn.shopify.com/s/files/1/0432/3550/8381/files/xutobitemiwilixuzu.pdf
    • https://cdn.shopify.com/s/files/1/0436/1024/3229/files/grade_5_math_variables_and_expressions_worksheets.pdf
    • https://cdn.shopify.com/s/files/1/0431/3733/5464/files/xefasafovositomarunuzag.pdf
    • https://cdn.shopify.com/s/files/1/0436/1958/2110/files/50740359333.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000064d7.bin
3a6a1878767bcadc2e11921ab8c4f1d8a8469aebf7dc99b1baed3f11753ab446		 pdf-font-stream PDF embedded font (sfnt) at offset 0x64D7 6004 bytes
font_01_sfnt_off00007943.bin
fc8e5c9d91a1771f6910086a6ca79599fb5f28b2ca6255d858291bf325a07796		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7943 10220 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.