Malicious PDF — malware analysis report

Static analysis result for SHA-256 376e8c10f36222f8…

MALICIOUS

PDF

47.2 KB Created: 2020-09-16 17:59:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 038cd3790a7bed278a8e49f3a88cd95a SHA-1: 99b7d0f7259e8d2016f2d6256822c3cd4c0ef07f SHA-256: 376e8c10f36222f84eb3bc52c4ef38d4f8488ad96e21c35fcd09aa1cd9c7ebd7
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a heuristic firing for a malicious redirector link pointing to 'ttraff.ru'. Additionally, it exhibits characteristics of an advance-fee scam lure, suggesting the document's content is designed to trick users into clicking malicious links. The embedded URL 'https://ttraff.ru/wix?keyword=just+build+unblocked+76' is the primary indicator of malicious redirection, likely leading to a phishing or malware download site.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=just+build+unblocked+76
    • https://cdn.shopify.com/s/files/1/0465/2636/5854/files/wolexisogipavugikuj.pdf
    • https://cdn.shopify.com/s/files/1/0437/5055/5799/files/43456899496.pdf
    • https://cdn.shopify.com/s/files/1/0431/5486/6333/files/linux_command_line_split.pdf
    • https://cdn.shopify.com/s/files/1/0429/2870/1603/files/fizarowurisiwefabepuxebak.pdf
    • https://cdn.shopify.com/s/files/1/0432/7417/4622/files/95784479616.pdf
    • https://14379d81-c371-4c17-96d3-8c379952b0d3.filesusr.com/ugd/b56239_e3036553c238487b8343e9da5bd7bcd6.pdf?index=true
    • https://ecaa4efb-93b1-44b2-9fa2-5ff0c11f3bc4.filesusr.com/ugd/451a43_ddb3b32531f94a6994f73f725c42f951.pdf?index=true
    • https://dd50a782-52a2-465f-9808-dd236df9590f.filesusr.com/ugd/c722c2_e6164d4687d6497a95e4dcdf71c5e669.pdf?index=true
    • https://f0061dc3-f76b-43eb-b1e8-8520b401e756.filesusr.com/ugd/834936_711d97f6d5684d249bf1f66cb23bb0bd.pdf?index=true
    • https://2cdc0cb1-2bb9-41b0-8309-a0380b4b8b7c.filesusr.com/ugd/ac8c68_dd20c454b3694f6194d7eadcd3e5e724.pdf?index=true
    • https://cdn.shopify.com/s/files/1/0435/9431/7981/files/split_merged_files.pdf
    • https://cdn.shopify.com/s/files/1/0433/4141/4552/files/38992879969.pdf
    • https://52723aca-1f9f-4ce4-a509-bef15311c9c0.filesusr.com/ugd/dc8a8e_231ee2051782473cae3d82fcbaad5b44.pdf?index=true
    • https://1b4fb7df-b554-4c53-b114-e5405d3a6707.filesusr.com/ugd/17ce20_936dde7dd0eb4678a2dae7a110928fdc.pdf?index=true
    • https://6afc446a-e2d3-4272-bc14-a83cb5013ded.filesusr.com/ugd/dfb5f8_ac886f29abfd4214acd02537a83013da.pdf?index=true
    • https://e1dad806-b84a-4710-869f-79ad62085e20.filesusr.com/ugd/29c71c_5ce4c92e5abe42bb89516dcc886a26cb.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006d3f.bin
0774b1e99297ca83ca4126a699dd0c947a8b575d26d395939d12413085f100d5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6D3F 4936 bytes
font_01_sfnt_off00007e1c.bin
41c203292dfa6dcfe9266dc82a06c3f4e282b4532624496ba6628d537a81cda2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7E1C 10452 bytes
font_02_sfnt_off0000a1a9.bin
4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA1A9 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.