Malicious PDF — malware analysis report

Static analysis result for SHA-256 44d05eb3820f49d6…

MALICIOUS

PDF

46.4 KB Created: 2020-08-13 22:54:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6f137d27b00ff1bb07cfb499693f4715 SHA-1: 9d65e5ba4b4f7227efee0c2622a325f1c2d00922 SHA-256: 44d05eb3820f49d6e82ca489e98ca25bb9c18a700904c11a86fd97bc64ad3380
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a mass of external links, with a critical heuristic identifying a link to a known malicious redirector at `https://ttraff.com/pify?keyword=aradhana+mp4+video+songs`. This suggests the document's primary purpose is to redirect users to malicious infrastructure, likely for phishing or malware delivery. While the document body mentions 'Aradhana mp4 video songs', this appears to be a lure to disguise the malicious intent of the embedded link farm.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=aradhana+mp4+video+songs
    • http://files.weststanlybaptistchurch.com/uploads/1/3/1/4/131454505/zesubavijaxuwax-rokid-bowariguza-fozunoneguze.pdf
    • http://files.carsfordummies.org/uploads/1/3/0/9/130969446/7081717.pdf
    • http://bakubenuf.blackburnbaptistchurch.co.uk/uploads/1/3/1/8/131871390/nufojalofi_duzederokumawi_gaweziv.pdf
    • https://cdn.shopify.com/s/files/1/0434/5780/6488/files/61243566852.pdf
    • https://cdn.shopify.com/s/files/1/0431/9005/9176/files/human_anatomy_systems.pdf
    • https://cdn.shopify.com/s/files/1/0436/9504/6824/files/70669709837.pdf
    • https://cdn.shopify.com/s/files/1/0447/8972/7381/files/xiwafit.pdf
    • https://cdn.shopify.com/s/files/1/0429/9299/2410/files/statistics_12th_edition_mcclave.pdf
    • https://cdn.shopify.com/s/files/1/0430/8585/6919/files/29630291334.pdf
    • https://cdn.shopify.com/s/files/1/0430/6790/0061/files/arthur_rimbaud_season_in_hell.pdf
    • https://cdn.shopify.com/s/files/1/0440/3747/2421/files/fusesunetodojagakofekokot.pdf
    • https://cdn.shopify.com/s/files/1/0434/4401/1168/files/35839428482.pdf
    • https://cdn.shopify.com/s/files/1/0449/8151/8494/files/introduction_discord_srvers.pdf
    • https://cdn.shopify.com/s/files/1/0432/6585/1542/files/18092129412.pdf
    • https://cdn.shopify.com/s/files/1/0440/0028/0734/files/medicina_alopata_ventajas_y_desventajas.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000047c0.bin
a1941939d3417fbaea74985f52b05081e1ee49249a44db6e4d836088e2520175
pdf-font-stream PDF embedded font (sfnt) at offset 0x47C0 5480 bytes
font_01_sfnt_off00005a3e.bin
2f585978b28c94bd0207a398a462a924e5f18831b75fbd1791ba2f466aacf01d
pdf-font-stream PDF embedded font (sfnt) at offset 0x5A3E 9880 bytes
font_02_sfnt_off00007c46.bin
e58e8e8d3617fa2f52d62469859eb662c26c1c1537dc21f5cc6f1aa71eaa6aed
pdf-font-stream PDF embedded font (sfnt) at offset 0x7C46 18776 bytes
font_03_sfnt_off000099e9.bin
b4bef5a120d7c1f17a5f9386384c3d48cdb88a4166441829fcdcb7b79c864cae
pdf-font-stream PDF embedded font (sfnt) at offset 0x99E9 4440 bytes