Malicious PDF — malware analysis report

Static analysis result for SHA-256 8d1484eb44b6d8d6…

MALICIOUS

PDF

56.4 KB Created: 2020-08-19 13:47:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5b1c6ea601e051979c6c1d3c476d4672 SHA-1: 9b913706be37e0bf3e802bb905a3331c600461a6 SHA-256: 8d1484eb44b6d8d6917b93f20b1c19b64a74537190437c6d0d91942ec7239885
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a critical heuristic firing for a malicious redirector link, specifically pointing to 'ttraff.ru' with a lure related to a 'voice chat app'. Additionally, it exhibits characteristics of a PDF SEO link farm, hosting numerous other PDFs on Shopify domains, likely to improve search engine ranking for malicious lures. The document body, though heavily obfuscated, contains the same malicious URL and references to the 'Aloha voice chat app', reinforcing the phishing pretext. No scripts were extracted, but the primary attack vector appears to be social engineering via a malicious link embedded within the PDF.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=aloha+voice+chat+app
    • http://pefil.rogue-photography.com/uploads/1/3/1/4/131452821/pabofus.pdf
    • http://files.anastasiasiberians.com/uploads/1/3/0/7/130739553/dajuto-xejitonukifute-buxemumaw-guliden.pdf
    • https://cdn.shopify.com/s/files/1/0428/5107/4204/files/bolararubi.pdf
    • https://cdn.shopify.com/s/files/1/0433/8565/1358/files/gofamivafazuramojason.pdf
    • https://cdn.shopify.com/s/files/1/0430/9745/6801/files/30600224737.pdf
    • https://cdn.shopify.com/s/files/1/0428/2197/6220/files/restart_apache_ubuntu.pdf
    • https://cdn.shopify.com/s/files/1/0431/1610/1793/files/64911531408.pdf
    • https://cdn.shopify.com/s/files/1/0441/1247/8360/files/10493699964.pdf
    • https://cdn.shopify.com/s/files/1/0431/1403/7409/files/51396466248.pdf
    • https://cdn.shopify.com/s/files/1/0434/0409/9740/files/concussion_return_to_work_protocol.pdf
    • https://cdn.shopify.com/s/files/1/0434/5767/5431/files/dr._cindy_trimm_prayer.pdf
    • https://cdn.shopify.com/s/files/1/0433/1687/1336/files/67695116947.pdf
    • https://cdn.shopify.com/s/files/1/0431/3582/8124/files/oxford_dictionary_english_free_download.pdf
    • https://cdn.shopify.com/s/files/1/0432/3776/9384/files/fcc_element_3_study_guide.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006860.bin
d01e7d3a4e99b645d6ba9e0529bed8734a3e49056909a36afbc23c6aac238715		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6860 3064 bytes
font_01_sfnt_off0000732b.bin
a3ffe065d1664d6539356464f6ddee4f6e1ebc95f8fd4f8461537a3befb3bf15		 pdf-font-stream PDF embedded font (sfnt) at offset 0x732B 4796 bytes
font_02_sfnt_off00008376.bin
5961e1060f9363c32da0f76125ac288f2eff24347133fcbed0194b84c37f2459		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8376 1996 bytes
font_03_sfnt_off00008cbe.bin
cbea0b725636acbe854805c90ad0b97a5abea906a3cc269b0ac63864b267577a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8CBE 10412 bytes
font_04_sfnt_off0000b089.bin
4ab3a76bf9d3edaf055ecb54765185e9447f6f6516dacd4a4229b85867cf6e5e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB089 20452 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.