Malicious PDF — malware analysis report

Static analysis result for SHA-256 3ad4dd34bfae5f58…

MALICIOUS

PDF

44.3 KB Created: 2020-08-06 21:34:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 91d5d6c8b949f3c30b4f5516df421629 SHA-1: c4f1fe0fbbe4e95946d4d54a89d3502c85d7dc0c SHA-256: 3ad4dd34bfae5f58386e55310c717ba7907ea0b620e7f99a1e5c0ffe578eaeef
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a heuristic firing for a malicious redirector link, which points to 'https://ttraff.ru/pify?keyword=formulario+reembolso+bradesco+saude+pdf'. The document body, though heavily obfuscated, contains text related to 'Formulario reembolso bradesco saude pdf', suggesting a lure for a reimbursement form. The file also exhibits characteristics of a link farm, with numerous embedded URLs, including one hosted on Shopify. The primary malicious IOC is the ttraff.ru redirector.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=formulario+reembolso+bradesco+saude+pdf
    • http://files.tccwadsworth.org/uploads/1/3/1/0/131070971/zakizesiz.pdf
    • http://files.ingridbego.com/uploads/1/3/1/6/131636889/nijixu_doliwures_jeduvaniri_mokonin.pdf
    • http://files.diligovita.com/uploads/1/3/0/7/130776327/batugowoserekasaw.pdf
    • https://cdn.shopify.com/s/files/1/0432/5271/1581/files/99371824242.pdf
    • https://cdn.shopify.com/s/files/1/0434/6216/4644/files/zunuxeritivopowuza.pdf
    • https://cdn.shopify.com/s/files/1/0431/6443/4589/files/pagugerugosobekuvo.pdf
    • https://cdn.shopify.com/s/files/1/0435/8651/9195/files/70167397004.pdf
    • https://cdn.shopify.com/s/files/1/0440/8508/4310/files/john_deere_l_130_manual.pdf
    • https://cdn.shopify.com/s/files/1/0432/3688/4642/files/52945078209.pdf
    • https://cdn.shopify.com/s/files/1/0433/5848/6678/files/xiverobasipumuf.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/9284441163.pdf?v=1594212706
    • https://cdn.shopify.com/s/files/1/0433/7437/9157/files/27601796994.pdf
    • https://cdn.shopify.com/s/files/1/0430/5040/1945/files/poranologesusoxomokoj.pdf
    • https://cdn.shopify.com/s/files/1/0435/8048/9891/files/mibapetisifimigamojekatir.pdf
    • https://cdn.shopify.com/s/files/1/0431/9212/3560/files/6834546910.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000065c3.bin
bd956cd8b2bde6bca554c206459dfca3dfdf85a862f83c47a22f32fda68e8594		 pdf-font-stream PDF embedded font (sfnt) at offset 0x65C3 5396 bytes
font_01_sfnt_off000077fc.bin
48bd187d22ce8c387084644ca51a17ba125af6d992e9bfb4636f08d5c6177a5f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x77FC 14128 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.