Malicious PDF — malware analysis report

Static analysis result for SHA-256 3bac753124044134…

MALICIOUS

PDF

41.6 KB Created: 2020-08-24 01:44:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6bf6129911c6b9e90706a25b39ecfc04 SHA-1: 6bab605e446ddba16522993f16cce4aa246a3063 SHA-256: 3bac75312404413491db1fde1fcac58a1b49b9cbbf621525def26ffb667d5f42
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains numerous embedded links, a common tactic for redirecting users to malicious sites. The heuristic PDF_MALICIOUS_REDIRECTOR_LINK specifically flags a link to 'ttraff.ru', indicating malicious redirector infrastructure. Additionally, the PDF_SEO_LINK_FARM heuristic indicates a large number of external links, many pointing to Shopify domains, likely part of a link farm to improve search engine ranking for malicious content. The document body contains text related to 'Boney m christmas audio songs free', suggesting a lure to attract users searching for popular content.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=boney+m+christmas+audio+songs+free
    • http://wenowi.uufellowship.org/uploads/1/3/1/4/131437940/mokabow_tiruzulun_lijafug_lulomofapojugu.pdf
    • http://fukodazin.bakerymadbatter.com/uploads/1/3/1/3/131380005/8647691.pdf
    • https://cdn.shopify.com/s/files/1/0441/1647/6056/files/biday_byomkesh_bengali_movie_free.pdf
    • https://cdn.shopify.com/s/files/1/0437/7883/4586/files/pimibiwof.pdf
    • https://cdn.shopify.com/s/files/1/0432/6424/5922/files/26220670106.pdf
    • https://cdn.shopify.com/s/files/1/0460/2216/4639/files/78332733852.pdf
    • https://cdn.shopify.com/s/files/1/0435/1701/8267/files/image_line_sign_up.pdf
    • https://cdn.shopify.com/s/files/1/0434/8212/0358/files/lipew.pdf
    • https://cdn.shopify.com/s/files/1/0436/9596/4314/files/83869458179.pdf
    • https://cdn.shopify.com/s/files/1/0436/2724/9826/files/75581626016.pdf
    • https://cdn.shopify.com/s/files/1/0429/8581/6218/files/nimov.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004c91.bin
d240ee78b4fcefbde849464c4faac63b33b9d686e65051f5d4064f1d8d877957		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4C91 1820 bytes
font_01_sfnt_off0000556c.bin
ee81b362b83b95d7503d3423b6e58461400b1918ea9a05aa1bb5c5d917e98e53		 pdf-font-stream PDF embedded font (sfnt) at offset 0x556C 5556 bytes
font_02_sfnt_off00006823.bin
bb888a7c9c6caae95aaa3d4f94075cd2ecd2830dd6ce7020a8eaedaf7fb914ff		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6823 15988 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.