Malicious PDF — malware analysis report

Static analysis result for SHA-256 486a51398b3fd4a4…

MALICIOUS

PDF

42.5 KB Created: 2020-08-14 21:25:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7a1f0bf60aff4799c32792db9cc47fcd SHA-1: e49d9c0a04e45fc4a5f55473bbd62e0547f49b08 SHA-256: 486a51398b3fd4a42ecb41eac35aaca649e09d56c73ae2ab1da5f53d8d3f75c9
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a critical heuristic firing for a malicious redirector link, pointing to 'ttraff.ru'. The document body, though heavily obfuscated, contains the string 'Angry birds 2 images' and the malicious URL, suggesting a lure. The file also exhibits characteristics of a PDF link farm, with numerous embedded links, many hosted on Shopify, likely for SEO manipulation or to obscure the final malicious destination. No scripts were extracted from this sample.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=angry+birds+2+images
    • http://files.htrsusa.com/uploads/1/3/1/6/131606550/6523112.pdf
    • http://files.riseup-greencity.org/uploads/1/3/2/8/132816165/zobimirikapuliv_xotap_tuwobe_sotawaxipusev.pdf
    • https://cdn.shopify.com/s/files/1/0428/0333/1231/files/pusidatalaparo.pdf
    • https://cdn.shopify.com/s/files/1/0428/0470/7491/files/74404827482.pdf
    • https://cdn.shopify.com/s/files/1/0428/5412/1635/files/68354520143.pdf
    • https://cdn.shopify.com/s/files/1/0438/9843/7784/files/tabela_de_ions_cations_e_anions.pdf
    • https://cdn.shopify.com/s/files/1/0430/3929/3589/files/26108023343.pdf
    • https://cdn.shopify.com/s/files/1/0435/9513/7181/files/bollywood_hd_movies_websites_list.pdf
    • https://cdn.shopify.com/s/files/1/0432/7519/0430/files/87675369766.pdf
    • https://cdn.shopify.com/s/files/1/0436/9488/2984/files/combine_files_download.pdf
    • https://cdn.shopify.com/s/files/1/0437/1641/1547/files/nusawepelusozo.pdf
    • https://cdn.shopify.com/s/files/1/0432/2908/5859/files/sosyal_bilgiler_testi_6._snf.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004753.bin
d9d832a62e5c9ccfb8cb0189037c5cc7021c0a49ec567bf81d7a6258faaec3b1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4753 5476 bytes
font_01_sfnt_off000059d2.bin
164bb797bea488b7a5b49ed9fd292f1861e0a859e0f6a711ee5d193b48261007		 pdf-font-stream PDF embedded font (sfnt) at offset 0x59D2 14220 bytes
font_02_sfnt_off0000869f.bin
4b52fd5da643d9c08cc0a86f773b2f024e3274f3f861dfcac100db1ef433cf06		 pdf-font-stream PDF embedded font (sfnt) at offset 0x869F 16164 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.