Malicious PDF — malware analysis report

Static analysis result for SHA-256 3ccf5dd0781a12f4…

MALICIOUS

PDF

131.7 KB Created: 2020-09-20 10:06:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7363e9263d1718222b674deb9103c9ee SHA-1: d5e4694f7ff156f53ded3050dd400426fc13a062 SHA-256: 3ccf5dd0781a12f471eeb2097cd3b8f602c2125192b3e49aa9cd6208fb3f4deb
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.ru/wix?keyword=engineering+mechanics+dynamics+7th+edition+solution+manual+pdf'. This URL is presented within the document body, disguised as a link to a textbook solution manual. The PDF also exhibits characteristics of a link farm, with numerous embedded URLs, many hosted on cdn.shopify.com, suggesting an attempt to manipulate search engine results or distribute malicious links.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=engineering+mechanics+dynamics+7th+edition+solution+manual+pdf
    • https://cdn.shopify.com/s/files/1/0435/6649/7960/files/torebiviriniretosodotus.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/30698029692.pdf
    • https://cdn.shopify.com/s/files/1/0437/7303/4657/files/turuniwebi.pdf
    • https://cdn.shopify.com/s/files/1/0435/5709/3525/files/blender_2._7_tutorials_for_beginners.pdf
    • https://cdn.shopify.com/s/files/1/0435/8828/8675/files/bowog.pdf
    • https://cdn.shopify.com/s/files/1/0432/4173/4311/files/67595471394.pdf
    • https://cdn.shopify.com/s/files/1/0431/4578/9606/files/solve_equations.pdf
    • https://cdn.shopify.com/s/files/1/0435/5696/2465/files/classical_guitar_lessons.pdf
    • https://cdn.shopify.com/s/files/1/0438/8772/2648/files/gidaxaxajopo.pdf
    • https://cdn.shopify.com/s/files/1/0430/8631/5671/files/69718555086.pdf
    • https://cdn.shopify.com/s/files/1/0433/4924/6102/files/tafaviwuberubuxiwikin.pdf
    • https://cdn.shopify.com/s/files/1/0457/6690/1924/files/scala_functional_programming_patterns.pdf
    • https://cdn.shopify.com/s/files/1/0432/2872/5405/files/10874960081.pdf
    • https://cdn.shopify.com/s/files/1/0435/4395/3563/files/najaxosetovasetanukilivo.pdf
    • https://cdn.shopify.com/s/files/1/0437/2758/5430/files/80306401341.pdf
    • https://cdn.shopify.com/s/files/1/0428/5959/3894/files/66329254860.pdf
    • https://cdn.shopify.com/s/files/1/0430/7694/4033/files/musam.pdf
    • https://cdn.shopify.com/s/files/1/0440/7230/4805/files/gujoxosiv.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00018f12.bin
43f1b403a93838eff801142c1fcd1b0724dec37bc20191b3e34efaba6f98311d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x18F12 5708 bytes
font_01_sfnt_off0001a26e.bin
e3b0db346e907ffd976b9824f00b5b5775f6ede7acca355cf28ad328f669f201		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1A26E 18136 bytes
font_02_sfnt_off0001da82.bin
59ef7ecded6db2ddeb64a2b436e5e7082190441c3e4c40ab1bc20b8dfab507e8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1DA82 16748 bytes
font_03_sfnt_off0001f124.bin
bbe108173d71bb3b930cb42e4ae56c471cc83acdd3c6c5f18d48d43f4645e54a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1F124 6080 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.