Malicious PDF — malware analysis report

Static analysis result for SHA-256 4bb470923acca8a0…

MALICIOUS

PDF

92.9 KB Created: 2020-08-07 07:34:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5c1554ea5fad67a3a333361665540e51 SHA-1: 8a8156df742bc682007e126c98f90e4aeab32369 SHA-256: 4bb470923acca8a00671eea640839411c19c577d192b8ff595093eac226872a2
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains numerous embedded URLs, with a critical heuristic firing indicating a link farm pointing to external PDFs. One of the primary URLs, 'https://ttraff.ru/pify?keyword=gesti%25C3%25B3n+de+calidad+total+metodolog%25C3%25ADa+y+herramientas+pdf', is flagged as a malicious redirector. The document body, though heavily obfuscated, also contains this URL, suggesting it is a key component of the malicious functionality. The presence of many external links, including those hosted on Shopify, points towards an attempt to manipulate search engine results or distribute malicious content through a large network of linked documents.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=gesti%25C3%25B3n+de+calidad+total+metodolog%25C3%25ADa+y+herramientas+pdf
    • http://files.mohicounseling.com/uploads/1/3/1/8/131871586/1131834.pdf
    • http://jezuf.castillosclasses.com/uploads/1/3/0/8/130873995/22c910d25a.pdf
    • http://files.ninjamagik.com/uploads/1/3/0/8/130874629/jatupisejumelovavog.pdf
    • https://cdn.shopify.com/s/files/1/0432/2246/6720/files/liwirarikasefawegonari.pdf
    • https://cdn.shopify.com/s/files/1/0437/2499/6773/files/53975436763.pdf
    • https://cdn.shopify.com/s/files/1/0434/1438/8892/files/fixajodawoduwevubomo.pdf
    • https://cdn.shopify.com/s/files/1/0431/0047/1456/files/57002655504.pdf
    • https://cdn.shopify.com/s/files/1/0429/6572/9429/files/heat_transfer_conduction_convection_radiation.pdf
    • https://cdn.shopify.com/s/files/1/0431/6204/2529/files/wii_wad_files.pdf
    • https://cdn.shopify.com/s/files/1/0435/3628/5860/files/nugitexudijata.pdf
    • https://cdn.shopify.com/s/files/1/0431/0866/3462/files/96891039948.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/57790570823.pdf
    • https://cdn.shopify.com/s/files/1/0427/7384/0038/files/pubunurezepusisiwizopetem.pdf
    • https://cdn.shopify.com/s/files/1/0434/1887/8114/files/jedi_outcast_walkthrough.pdf
    • https://cdn.shopify.com/s/files/1/0435/4700/0983/files/55687233958.pdf
    • https://cdn.shopify.com/s/files/1/0436/4537/0518/files/3847880123.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001293c.bin
082fe2f13e9c6c64cb8cda30f7ce58893a99fdf81c05c0a761c14482ef3d7cd9
pdf-font-stream PDF embedded font (sfnt) at offset 0x1293C 5892 bytes
font_01_sfnt_off00013cdf.bin
dbdccaf105721e4178912bc51d1e7e8159d76eee7e0b70e57d4ea77d4970579a
pdf-font-stream PDF embedded font (sfnt) at offset 0x13CDF 11640 bytes