Malicious PDF — malware analysis report

Static analysis result for SHA-256 7faaff5deb13e4d6…

MALICIOUS

PDF

59.5 KB Created: 2020-08-10 20:00:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 89145dc83a2c0c2bf0f92d9345ac302b SHA-1: c35aad1658226b8199370e70e433934024df99ed SHA-256: 7faaff5deb13e4d65ee7a2f583c2c66b229a6909bae9229351711bb5cc18e287
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a mass external link farm, with many links pointing to various domains and ultimately to a redirector at ttraff.ru. The document body text, though heavily obfuscated, contains the URL that leads to the redirector, suggesting a lure to download a fake PDF. The heuristic PDF_MALICIOUS_REDIRECTOR_LINK confirms the malicious nature of the redirector.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=bsc+botany+practical+manual+pdf
    • http://losuli.bayridgeschool.org/uploads/1/3/0/7/130739206/1757ed826673d.pdf
    • http://fifisumuw.abbottconstruction360.com/uploads/1/3/1/4/131438137/wurufabazefasu.pdf
    • http://files.milwaukeedowntownchiropractic.com/uploads/1/3/1/3/131384136/wivoz.pdf
    • http://gisoxakaj.peleeartworks.org/uploads/1/3/1/8/131871674/safeji_dokuxopoj_pejagovidin_tawazamalisi.pdf
    • https://cdn.shopify.com/s/files/1/0430/6790/0061/files/vuwujojov.pdf
    • https://cdn.shopify.com/s/files/1/0437/0684/3288/files/rogetoxamapodasuzoze.pdf
    • https://cdn.shopify.com/s/files/1/0437/1392/1189/files/52617406478.pdf
    • https://cdn.shopify.com/s/files/1/0431/5794/6519/files/xifagiku.pdf
    • https://cdn.shopify.com/s/files/1/0434/8936/2082/files/41698819012.pdf
    • https://cdn.shopify.com/s/files/1/0440/3222/9541/files/vawomasi.pdf
    • https://cdn.shopify.com/s/files/1/0431/9261/5073/files/12775915734.pdf
    • https://cdn.shopify.com/s/files/1/0431/2779/9970/files/53807910238.pdf
    • https://cdn.shopify.com/s/files/1/0435/6984/0283/files/39189127449.pdf
    • https://cdn.shopify.com/s/files/1/0439/1727/9400/files/contoh_soal_psikotes_matematika_dasar.pdf
    • https://cdn.shopify.com/s/files/1/0429/2119/7724/files/39780443592.pdf
    • https://cdn.shopify.com/s/files/1/0430/9119/8112/files/57148095585.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007a79.bin
de2dfd504f5624f81fa93de768b6688ec592a977e8dcc7ae31a86a65d97c490f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7A79 5592 bytes
font_01_sfnt_off00008d61.bin
3ec5eaebde275098412d8dff0e1045b52b4c0e5a23abac5807418a6329e69f43		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8D61 3204 bytes
font_02_sfnt_off00009a51.bin
026de1076dad6614fee7b4839f066e743e4238b5ddea94259138cfcd618330b4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9A51 2320 bytes
font_03_sfnt_off0000a4a3.bin
98a906818b8b42376ebdf1091268efcfdce3558813048f066eebd13b970a168e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA4A3 10912 bytes
font_04_sfnt_off0000c9ec.bin
7a7e0f9cb89785dee93ecfbcc78ef93b5a18a5022886c2d5a0bf15d9412c15a0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC9EC 16224 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.