Malicious PDF — malware analysis report

Static analysis result for SHA-256 3a81cf740841fcb8…

MALICIOUS

PDF

46.0 KB Created: 2020-08-20 01:50:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 893720e62cc0e574c0d8bc1c7dc16a1c SHA-1: 5c0ffcba59d207a83eb99e1a5be9d55d6fff463e SHA-256: 3a81cf740841fcb86a1ee435f77441fb31289ac2d632523fb0a163d8f231b2f7
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains numerous embedded links, including a critical redirector link to 'https://ttraff.ru/pify?keyword=call+recorder+free++girl'. This indicates a social engineering lure, likely attempting to trick the user into downloading further malware or visiting a malicious site. The document body, though heavily obfuscated, contains references to 'call recorder free girl' and the authoring application 'wkhtmltopdf', reinforcing the lure. The presence of a large number of external PDF links suggests a link farm for SEO poisoning or traffic redirection.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=call+recorder+free++girl
    • http://files.doubloondesigns.com/uploads/1/3/2/7/132740329/juxulozuwomekutu.pdf
    • http://files.somedailyjoe.com/uploads/1/3/0/7/130740163/5768259a8f53b63.pdf
    • http://files.soma-psyche.com/uploads/1/3/0/7/130775292/f977d93449.pdf
    • https://cdn.shopify.com/s/files/1/0431/6866/1670/files/faguzorebirufara.pdf
    • https://cdn.shopify.com/s/files/1/0437/8158/7093/files/2534402806.pdf
    • https://cdn.shopify.com/s/files/1/0428/1594/6911/files/boss_rc_30_manual.pdf
    • https://cdn.shopify.com/s/files/1/0435/8651/9197/files/fogibovupogoxuzo.pdf
    • https://cdn.shopify.com/s/files/1/0429/3902/3526/files/galomimowalemovukagu.pdf
    • https://cdn.shopify.com/s/files/1/0428/8462/8633/files/nosoridojanolujusawuguru.pdf
    • https://cdn.shopify.com/s/files/1/0427/6974/4028/files/60865384746.pdf
    • https://cdn.shopify.com/s/files/1/0435/7079/0558/files/nomonavutapinolo.pdf
    • https://cdn.shopify.com/s/files/1/0430/4519/1841/files/definicion_de_parestesia.pdf
    • https://cdn.shopify.com/s/files/1/0429/6127/2983/files/st_augustine_confessions_chadwick.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000069a8.bin
edceaa4582c7e10a354cc9a5007ae2f6a0145408add6d74f045e1597f5e27b0d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x69A8 4636 bytes
font_01_sfnt_off00007977.bin
051a22ad16cd664835f51431f435f649ad94d7036062125892d78600aad73871		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7977 10364 bytes
font_02_sfnt_off00009d17.bin
0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9D17 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.