Malicious PDF — malware analysis report

Static analysis result for SHA-256 7bd672852d653350…

MALICIOUS

PDF

36.4 KB Created: 2020-08-13 15:26:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7cab45a392e2be5541699f3e47356f59 SHA-1: 0a52740d36bd9aa7a08c58c8e53c809fe71903ed SHA-256: 7bd672852d653350c2046aed9f13f73c2bdad18623f09e05a52efed57cb234b7
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file exhibits characteristics of a link farm, with numerous embedded URLs. One critical heuristic identified a link to known malicious redirector infrastructure at 'https://ttraff.ru/pify?keyword=civitas+latino+libro+pdf'. Another heuristic detected a mass external PDF link farm, with many links pointing to shopify domains, suggesting an attempt to manipulate search engine results or distribute malicious content disguised as legitimate documents. The presence of these link farms and the malicious redirector strongly indicates an intent to lure users to harmful sites.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=civitas+latino+libro+pdf
    • http://rujefor.friends4picacho.org/uploads/1/3/0/8/130813095/28e12f7f6848e.pdf
    • http://files.speckmath.net/uploads/1/3/1/4/131437666/daxomixolosotenon.pdf
    • http://files.knotordinarywoodworking.com/uploads/1/3/0/8/130814529/5424892.pdf
    • http://files.samskriti.com/uploads/1/3/0/7/130775304/c8015abd4.pdf
    • https://cdn.shopify.com/s/files/1/0434/5865/8456/files/17249393251.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/nitopufekuriwuk.pdf
    • https://cdn.shopify.com/s/files/1/0438/0780/1504/files/meters_to_feet_and_inches.pdf
    • https://cdn.shopify.com/s/files/1/0429/0691/0876/files/convert_to_word_doc_on_macbook.pdf
    • https://cdn.shopify.com/s/files/1/0430/4293/0842/files/semalekujasuziket.pdf
    • https://cdn.shopify.com/s/files/1/0429/6992/3740/files/zutuvixopigero.pdf
    • https://cdn.shopify.com/s/files/1/0428/0261/0335/files/46271269203.pdf
    • https://cdn.shopify.com/s/files/1/0434/1481/4885/files/clasificacin_de_los_actos_de_comercio.pdf
    • https://cdn.shopify.com/s/files/1/0428/5526/8519/files/pizogolavimobekowaw.pdf
    • https://cdn.shopify.com/s/files/1/0428/5107/4214/files/identifying_triangles_worksheet_answers.pdf
    • https://cdn.shopify.com/s/files/1/0430/8110/5575/files/altered_chords.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004cb9.bin
e12edc956a84c8b31f746fc2f8f14f41ca2823ba3f77be204610f95c4c90f3b6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4CB9 5140 bytes
font_01_sfnt_off00005e3a.bin
4c89f67848b50f0f3606f419ca58559a2d2f77e0b3fdc30fe8a3c2e52cb3dd84		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5E3A 11648 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.