Malicious PDF — malware analysis report

Static analysis result for SHA-256 923b21e4aaa3f8fc…

MALICIOUS

PDF

48.5 KB Created: 2020-08-14 02:25:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3b085dcfb860d327bd40283d410bf30d SHA-1: 4d49e7fe5d3e9c7067f8c4dd5c35aa12525697ba SHA-256: 923b21e4aaa3f8fc58b9ba30576fe52512798c79c819b65e4b53fc700036e754
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links, a technique often used for SEO poisoning or to direct users to malicious sites. One of the links points to a known malicious redirector, ttraff.ru, which is a strong indicator of malicious intent. The document body contains garbled text but also includes the URL that triggered the malicious redirector heuristic, suggesting it's part of the lure. No scripts were extracted, and the family is unknown due to the lack of specific indicators.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=cabal+mobile+wizard+guide
    • http://files.abridgedinvesting.com/uploads/1/3/2/6/132680808/dotegogodox-logudilabim.pdf
    • http://files.kozaero.com/uploads/1/3/1/3/131379875/nifajajixe_xamofexarep_vofosaze_gebetufo.pdf
    • http://files.roryfitzgeraldbledsoe.com/uploads/1/3/0/8/130874332/165242.pdf
    • https://cdn.shopify.com/s/files/1/0432/3000/3355/files/john_deere_z425_parts.pdf
    • https://cdn.shopify.com/s/files/1/0429/0255/2742/files/19356580817.pdf
    • https://cdn.shopify.com/s/files/1/0428/2885/7503/files/high_carbohydrate_foods_list.pdf
    • https://cdn.shopify.com/s/files/1/0431/8907/6117/files/ludizaxapesozaru.pdf
    • https://cdn.shopify.com/s/files/1/0428/1312/8863/files/bunyoro_kingdom.pdf
    • https://cdn.shopify.com/s/files/1/0431/6279/6186/files/funube.pdf
    • https://cdn.shopify.com/s/files/1/0429/7365/9290/files/46239871657.pdf
    • https://cdn.shopify.com/s/files/1/0434/4076/7132/files/mac_os_catalina_size.pdf
    • https://cdn.shopify.com/s/files/1/0430/1013/0073/files/nagekabilo.pdf
    • https://cdn.shopify.com/s/files/1/0432/9612/9192/files/latest_boy_baby_names_in_tamil.pdf
    • https://cdn.shopify.com/s/files/1/0434/3214/9148/files/26893388674.pdf
    • https://cdn.shopify.com/s/files/1/0432/2741/4695/files/13673528692.pdf
    • https://cdn.shopify.com/s/files/1/0431/6109/2250/files/xubebirafopakuwov.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006844.bin
626fccdbc45aa4e94546a3d7a661a21f96af6de6f23d059e3c641dbde6cf61c4
pdf-font-stream PDF embedded font (sfnt) at offset 0x6844 4968 bytes
font_01_sfnt_off0000793a.bin
51ebeec29509b87aa858d500e37ac8853184703d07d1f913ce36d8e1dc7764c0
pdf-font-stream PDF embedded font (sfnt) at offset 0x793A 1800 bytes
font_02_sfnt_off000081c8.bin
4e0ec1d0a45e15dbb8f37fa27a326af3551e73b750bb1fbd4eb0e80d55b0b24e
pdf-font-stream PDF embedded font (sfnt) at offset 0x81C8 10648 bytes
font_03_sfnt_off0000a634.bin
cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34
pdf-font-stream PDF embedded font (sfnt) at offset 0xA634 4324 bytes