Malicious PDF — malware analysis report

Static analysis result for SHA-256 951f526c79e2913b…

MALICIOUS

PDF

50.9 KB Created: 2020-08-12 15:01:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 69ea7ec190fc3c43a30508fd85d97929 SHA-1: a03b5539dba0feb172c47e1254a4e1e94b223e05 SHA-256: 951f526c79e2913b2353d685a72eb7c5767440d7593093afa3af8df1378ff44c
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a heuristic firing for a malicious redirector link, pointing to 'https://ttraff.ru/pify?keyword=arabisch+lernen+pdf+download'. This URL is presented within the document body as a lure for downloading an Arabic learning PDF. The file also exhibits characteristics of a link farm, with numerous external links, many pointing to Shopify domains. The primary malicious IOC is the redirector URL, which likely leads to further malicious content.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=arabisch+lernen+pdf+download
    • http://files.myscentsandessentials.com/uploads/1/3/2/3/132303238/c50b63cf9262.pdf
    • http://files.tallitministries.com/uploads/1/3/1/4/131409127/419881.pdf
    • http://files.biz-skills.com/uploads/1/3/2/6/132681851/7268867.pdf
    • https://cdn.shopify.com/s/files/1/0435/6082/9087/files/26892252936.pdf
    • https://cdn.shopify.com/s/files/1/0431/0971/2021/files/22632134388.pdf
    • https://cdn.shopify.com/s/files/1/0429/6799/0438/files/72611044428.pdf
    • https://cdn.shopify.com/s/files/1/0434/0708/1630/files/22136167172.pdf
    • https://cdn.shopify.com/s/files/1/0433/6818/6024/files/zofam.pdf
    • https://cdn.shopify.com/s/files/1/0432/2469/4942/files/61354139207.pdf
    • https://cdn.shopify.com/s/files/1/0433/6176/3480/files/pharmacological_treatment_of_hypertension.pdf
    • https://cdn.shopify.com/s/files/1/0430/0632/8995/files/neloberisuku.pdf
    • https://cdn.shopify.com/s/files/1/0436/4759/8742/files/pneumopathie_d_inhalation_traitement.pdf
    • https://cdn.shopify.com/s/files/1/0431/0417/4233/files/toro_timecutter_ss5000.pdf
    • https://cdn.shopify.com/s/files/1/0429/6422/2101/files/posusenegupikuzaki.pdf
    • https://cdn.shopify.com/s/files/1/0435/9376/0931/files/sahih_al_bukhari_download.pdf
    • https://cdn.shopify.com/s/files/1/0436/2931/4206/files/bartolinitis_tratamiento.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008534.bin
7a90263446711fa3b0f73b32b7fbc1f9dfea7d19b51b4089724685670362db61		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8534 5464 bytes
font_01_sfnt_off000097c4.bin
84a27cb7ccaf0aaa2ae26e1e7f58df4e10c058dcac41c00393d5d7dbd6161b6d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x97C4 11356 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.