Malicious PDF — malware analysis report

Static analysis result for SHA-256 998430d395ac061f…

MALICIOUS

PDF

48.8 KB Created: 2020-07-30 07:43:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6f7206d95343fa61a7f4947f8af19d49 SHA-1: f05817cd5de115e82256ebd800ce0a0da4176b02 SHA-256: 998430d395ac061f7494378f2a926b3505f02bd715ec3af90ee9082ebd36d12a
160 Risk Score

Malware Insights

MITRE ATT&CK
T1059.003 Windows Command Shell T1204.002 Malicious Link

The PDF contains a heuristic firing for a malicious redirector link pointing to 'ttraff.ru', which is associated with malicious activity. Additionally, it includes a large number of embedded links to PDFs hosted on Shopify, suggesting a link farm for SEO poisoning or distribution. The 'SE_CLIPBOARD_COMMAND_LURE' heuristic indicates the document instructs the user to copy and paste content into a command-line interface, a common tactic for executing downloaded payloads. The document body itself is heavily obfuscated and appears to be junk data, but the presence of the URL and the command lure heuristics strongly suggest a malicious intent to trick the user into executing commands.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE
    Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=adobe+premiere+cc+tutorial+pdf
    • http://files.crossplainsdental.com/uploads/1/3/2/6/132682030/votonagaxak.pdf
    • http://files.incredibottle.com/uploads/1/3/1/3/131383548/34658f70a74.pdf
    • http://files.stjameshaubstadt.com/uploads/1/3/1/0/131071056/mibofotoxezufejunano.pdf
    • http://files.hazletontrinityschool.com/uploads/1/3/2/3/132303010/88c7835e7e.pdf
    • http://files.stjameshaubstadt.com/uploads
    • https://cdn.shopify.com/s/files/1/0429/8833/9361/files/gubevugovowajuturov.pdf
    • https://cdn.shopify.com/s/files/1/0427/7354/5116/files/xefox.pdf
    • https://cdn.shopify.com/s/files/1/0433/0664/7717/files/12417328616.pdf
    • https://cdn.shopify.com/s/files/1/0437/5799/4138/files/xekerenijigefeg.pdf
    • https://cdn.shopify.com/s/files/1/0432/5674/2046/files/28814990918.pdf
    • https://cdn.shopify.com/s/files/1/0431/6309/1112/files/97109634985.pdf
    • https://cdn.shopify.com/s/files/1/0431/2986/4343/files/voxuxaxafago.pdf
    • https://cdn.shopify.com/s/files/1/0432/2351/5294/files/zobunenarowadusagipe.pdf
    • https://cdn.shopify.com/s/files/1/0431/2068/9306/files/vaxonalulojureme.pdf
    • https://cdn.shopify.com/s/files/1/0440/6876/5848/files/63275630882.pdf
    • https://cdn.shopify.com/s/files/1/0428/0687/0183/files/89867256479.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/16481260084.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000076b2.bin
c44dfbd9e4ad6338d5d7cd5105839ca17044ed4418c7b747dc0315e3bb79dca2
pdf-font-stream PDF embedded font (sfnt) at offset 0x76B2 5028 bytes
font_01_sfnt_off000087c8.bin
87da2827caad006acf728413b044e200e092d96fa2cba59a9353f674e1323eac
pdf-font-stream PDF embedded font (sfnt) at offset 0x87C8 15004 bytes