Malicious PDF — malware analysis report

Static analysis result for SHA-256 52b8f24a634fafd1…

MALICIOUS

PDF

47.5 KB Created: 2020-08-13 03:09:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2f3280a67a3d2012ab338bf6dc98d923 SHA-1: 36585db9ceb581c7058759045383dd2a7c121b03 SHA-256: 52b8f24a634fafd10ab686b62ed39519b5163edf5158b2bb96bb0acc3c5c391b
138 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains numerous links, including one pointing to a known malicious redirector (ttraff.ru) and a large number of links to PDFs hosted on cdn.shopify.com, suggesting a link farm for SEO manipulation or to obscure malicious destinations. The document body, though heavily obfuscated, contains the URL https://ttraff.ru/pify?keyword=botany+textbook+pdf+class+11, which is flagged as a malicious redirector. This indicates a likely attempt to redirect users to malicious sites under the guise of providing a PDF document.

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=botany+textbook+pdf+class+11
    • http://lidav.ragsandrust.co.uk/uploads/1/3/1/4/131408100/dc22708a5236da9.pdf
    • http://files.fantasticalfaces.com/uploads/1/3/0/7/130740391/bumunemiri-tifasakikedidi-nisiribisa-domikibuz.pdf
    • http://files.thecookteaser.com/uploads/1/3/1/6/131607662/zutataweranul.pdf
    • http://files.kenowahillsdctrip.com/uploads/1/3/0/9/130969206/1537877.pdf
    • http://mufuges.swiptt.com/uploads/1/3/2/8/132814930/7610777.pdf
    • https://cdn.shopify.com/s/files/1/0444/3848/7206/files/present_perfect_past_simple_exercise.pdf
    • https://cdn.shopify.com/s/files/1/0439/7475/4462/files/12863873251.pdf
    • https://cdn.shopify.com/s/files/1/0431/8350/5562/files/jquery_remove_all_classes.pdf
    • https://cdn.shopify.com/s/files/1/0430/4669/9165/files/scert_assam_d._el._ed_result_2020.pdf
    • https://cdn.shopify.com/s/files/1/0431/9802/1793/files/metabolismo_purinas_y_pirimidinas.pdf
    • https://cdn.shopify.com/s/files/1/0434/3418/0769/files/28270985322.pdf
    • https://cdn.shopify.com/s/files/1/0430/0223/2983/files/69437430183.pdf
    • https://cdn.shopify.com/s/files/1/0431/9408/9635/files/zofos.pdf
    • https://cdn.shopify.com/s/files/1/0433/5117/9423/files/beowulf_new_english.pdf
    • https://cdn.shopify.com/s/files/1/0434/6960/2981/files/vojixarowenekigeb.pdf
    • https://cdn.shopify.com/s/files/1/0454/5744/0926/files/sociology_books_for_upsc.pdf
    • https://cdn.shopify.com/s/files/1/0435/0902/2886/files/63515356862.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007bb7.bin
726a8e086941d013020a0d6b8ac56f6c936af8219da8b1771d17f89fdadc5ae9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7BB7 5528 bytes
font_01_sfnt_off00008eae.bin
9adc403df8066ff58a5475dc434f2e1db1dfaf128f03714e08a4e0fa4a564e45		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8EAE 10120 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.