Malicious PDF — malware analysis report

Static analysis result for SHA-256 3af1d927fbfc5fd0…

MALICIOUS

PDF

39.7 KB Created: 2020-08-11 06:55:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 793c08395d96aa8ded6e6b315b22cc41 SHA-1: ecefc6bbd387f7f3217d0968079072d5a1cfc496 SHA-256: 3af1d927fbfc5fd063d9dbdfed620634568ab6325507e6f28691c5943864379e
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF file contains a large number of embedded links, many of which point to Shopify domains hosting other PDFs, suggesting a link farm for SEO manipulation. One critical heuristic identified a link to a known malicious redirector, ttraff.ru, which is used to obscure the final destination. The document body text and embedded URLs indicate a lure related to downloading a novel, likely to trick users into clicking the malicious link.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=download+love+after+marriage+novel+urdu+pdf
    • http://files.scaretour.co.uk/uploads/1/3/1/6/131637695/948163.pdf
    • http://rulabuni.asldeanpapalia.com/uploads/1/3/1/3/131383629/sokefamos-munamedi-nurowigiwi.pdf
    • http://files.buildingfaithfamily.com/uploads/1/3/2/7/132740204/c5671671fb4a4a.pdf
    • http://vodeja.shopdomesticity.com/uploads/1/3/1/3/131381464/litotosunaw_xuxazaxewiku_ridiretofi_damubixizir.pdf
    • https://cdn.shopify.com/s/files/1/0428/9753/9231/files/c_this_pointer.pdf
    • https://cdn.shopify.com/s/files/1/0433/9453/1484/files/papazulujinudo.pdf
    • https://cdn.shopify.com/s/files/1/0433/0776/1819/files/analytic_number_theory_notes.pdf
    • https://cdn.shopify.com/s/files/1/0438/2785/5517/files/vajidozede.pdf
    • https://cdn.shopify.com/s/files/1/0430/0305/2191/files/92157199953.pdf
    • https://cdn.shopify.com/s/files/1/0434/6786/6278/files/sobutuko.pdf
    • https://cdn.shopify.com/s/files/1/0434/8447/9641/files/nata_position_statements.pdf
    • https://cdn.shopify.com/s/files/1/0434/0586/9213/files/gutubedizodomononefap.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/favubedezemopazejive.pdf
    • https://cdn.shopify.com/s/files/1/0432/6604/8165/files/rumifejudivutapoduj.pdf
    • https://cdn.shopify.com/s/files/1/0433/2571/8678/files/diwonowubexepipokovi.pdf
    • https://cdn.shopify.com/s/files/1/0436/6788/2134/files/27920844248.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005c60.bin
a739ef4e3c1feb992d34a976a0eb90eaf76af92dbed5daaa6634496f1f662542		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5C60 5336 bytes
font_01_sfnt_off00006e8f.bin
db77e44b53aa0322565b5326c2c521f118da0d86927569e4d1ec6f369a0fc069		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6E8F 10196 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.