Malicious PDF — malware analysis report

Static analysis result for SHA-256 3b5eccece65c2698…

MALICIOUS

PDF

48.9 KB Created: 2020-08-24 17:48:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 64d877068b8ad13146344e658cf8203d SHA-1: 38485f7cd154f806ef56b70b50ca0e7241b92bdb SHA-256: 3b5eccece65c2698cd466c0ec0239bf20caf48a6f07b405a959c4360376f9ddc
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a critical heuristic firing for a malicious redirector link, specifically pointing to 'https://ttraff.ru/pify?keyword=saint+seiya+awakening+summon+guide'. This URL is presented within the document body, disguised as a game guide, to entice users to click. The PDF also exhibits characteristics of a link farm, with numerous embedded links, many pointing to Shopify domains, likely for SEO manipulation or to obscure the malicious destination. The primary malicious IOC is the redirector URL.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=saint+seiya+awakening+summon+guide
    • http://rexad.verapravda.com/uploads/1/3/0/7/130740221/e816f1f144.pdf
    • http://files.theoffsideflag.com/uploads/1/3/2/6/132695321/03a74ea90e.pdf
    • http://files.stbrendansvillage.com/uploads/1/3/2/6/132681812/bifojetuveponodoto.pdf
    • https://cdn.shopify.com/s/files/1/0427/4742/9031/files/85323849460.pdf
    • https://cdn.shopify.com/s/files/1/0432/8128/5286/files/rixerilu.pdf
    • https://cdn.shopify.com/s/files/1/0428/7361/8599/files/invalid_zip_code.pdf
    • https://cdn.shopify.com/s/files/1/0436/2282/6142/files/moded.pdf
    • https://cdn.shopify.com/s/files/1/0429/1392/3228/files/70745064713.pdf
    • https://cdn.shopify.com/s/files/1/0434/3640/8982/files/kodewen.pdf
    • https://cdn.shopify.com/s/files/1/0431/6158/3776/files/kopalususuwibunadorut.pdf
    • https://cdn.shopify.com/s/files/1/0447/9670/6967/files/agroforestry_technologies.pdf
    • https://cdn.shopify.com/s/files/1/0434/0783/5303/files/74547954755.pdf
    • https://cdn.shopify.com/s/files/1/0433/8896/0933/files/bncc_download.pdf
    • https://cdn.shopify.com/s/files/1/0434/9788/1766/files/chennai_times_today_epaper.pdf
    • https://cdn.shopify.com/s/files/1/0433/1362/7294/files/xaduzikazijufiwezobiku.pdf
    • https://cdn.shopify.com/s/files/1/0433/3384/5150/files/todatixabe.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000071c4.bin
430e2ab2fb6f48e3809b08ffb7fa0cbe0f13de31b77fd3a346325d54c5ff84e7
pdf-font-stream PDF embedded font (sfnt) at offset 0x71C4 5260 bytes
font_01_sfnt_off000083a4.bin
b0e836ef704d06920f82512ff755a40f99322325fcfe0cfef50b185d779517a9
pdf-font-stream PDF embedded font (sfnt) at offset 0x83A4 10860 bytes
font_02_sfnt_off0000a886.bin
9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2
pdf-font-stream PDF embedded font (sfnt) at offset 0xA886 4324 bytes