Malicious PDF — malware analysis report

Static analysis result for SHA-256 59526f6e9ca34596…

MALICIOUS

PDF

45.5 KB Created: 2020-08-03 04:48:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2cc7fb1c025358ed2a7e1e62cdd42c00 SHA-1: bc2e22b52c08a3f599f57f3600ba7e8152cc4e76 SHA-256: 59526f6e9ca34596c1961622ea940842f80be132963abcce280028defebf7300
130 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious Link T1566.002 Spearphishing Attachment

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'https://ttraff.ru/pify?keyword=optiplex+790+drivers'. Additionally, it exhibits characteristics of a PDF link farm, with numerous links hosted on cdn.shopify.com, suggesting an attempt to manipulate search engine results or distribute malicious content. The document body, though heavily obfuscated, contains the same URL, reinforcing the malicious intent.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=optiplex+790+drivers
    • http://files.slantsystem.com/uploads/1/3/1/6/131637484/9112563.pdf
    • http://files.pheobeandlulu.com.au/uploads/1/3/1/4/131407823/8829528.pdf
    • http://bopelume.awardsgeek.com/uploads/1/3/2/8/132815002/5798431.pdf
    • https://cdn.shopify.com/s/files/1/0432/3488/5792/files/skyrim_realistic_aspen_trees.pdf
    • https://cdn.shopify.com/s/files/1/0432/3311/6317/files/rusajirixipaludadag.pdf
    • https://cdn.shopify.com/s/files/1/0434/0976/8604/files/sisodizosobosadavaruj.pdf
    • https://cdn.shopify.com/s/files/1/0434/7274/8709/files/fipidudipeletito.pdf
    • https://cdn.shopify.com/s/files/1/0437/8198/0321/files/jofijil.pdf
    • https://cdn.shopify.com/s/files/1/0429/8362/0757/files/1748514121.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/52209678420.pdf
    • https://cdn.shopify.com/s/files/1/0440/7807/1960/files/33312941889.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/87743453122.pdf
    • https://cdn.shopify.com/s/files/1/0434/0776/9750/files/fesuxuxinomewadewaro.pdf
    • https://cdn.shopify.com/s/files/1/0431/7102/0964/files/20632549921.pdf
    • https://cdn.shopify.com/s/files/1/0438/9735/6443/files/gun_in_mouth_emoji.pdf
    • https://cdn.shopify.com/s/files/1/0436/4645/1862/files/benobonub.pdf
    • https://cdn.shopify.com/s/files/1/0433/9073/0398/files/96176249969.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000073dd.bin
ae421200e1a516575a16bc102cd98e2d82c6569fdbd8103db0da00bdc064e547
pdf-font-stream PDF embedded font (sfnt) at offset 0x73DD 5276 bytes
font_01_sfnt_off000085ef.bin
5c60beb8b5bf665e28c8d4b8a2cb81dacd3481c8b83a377ef417ced11954200f
pdf-font-stream PDF embedded font (sfnt) at offset 0x85EF 10184 bytes